What is the CVSS score of EUVD-2026-14774?

EUVD-2026-14774 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Android are affected by EUVD-2026-14774?

A memory exhaustion vulnerability in Android-ImageMagick7 allows remote attackers to disable services that depend on this library without authentication or user interaction.. A patch is available.

How to fix or mitigate EUVD-2026-14774?

Within 24 hours: inventory all applications and systems using Android-ImageMagick7 and their current versions; notify relevant development and product teams. Within 7 days: test and deploy patched version 7.1.2-11 to non-production environments; schedule production deployment windows. Within 30 days: complete production rollout across all affected applications and verify patch installation.

Android EUVD-2026-14774

| CVE-2026-33852 HIGH

Memory Leak (CWE-401)

2026-03-24 GovTech CSG

GHSA-72f8-jfg6-jwc2

Google Information Disclosure Android

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 24, 2026 - 06:45 euvd

EUVD-2026-14774

Analysis Generated

Mar 24, 2026 - 06:45 vuln.today

Patch released

Mar 24, 2026 - 06:45 nvd

Patch available

CVE Published

Mar 24, 2026 - 06:01 nvd

HIGH 7.5

DescriptionCVE.org

Missing Release of Memory after Effective Lifetime vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.

AnalysisAI

This vulnerability is a memory leak (CWE-401) in Android-ImageMagick7, a port of ImageMagick for Android, that allows remote attackers to cause denial of service by exhausting memory resources. The issue affects all versions of MolotovCherry Android-ImageMagick7 prior to version 7.1.2-11. With a CVSS score of 7.5 and a network-based attack vector requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N), attackers can remotely trigger high-impact availability disruption, though there is no current evidence of active exploitation or public proof-of-concept.

Technical ContextAI

Android-ImageMagick7 is a native Android port of the ImageMagick image processing library, providing comprehensive image manipulation capabilities for Android applications. The affected component (cpe:2.3:a:molotovcherry:android-imagemagick7) suffers from CWE-401 (Missing Release of Memory after Effective Lifetime), commonly known as a memory leak. This occurs when the application allocates memory during image processing operations but fails to properly release it after the memory is no longer needed. Over time or through repeated requests, this leads to progressive memory exhaustion, degrading performance and eventually causing application crashes or system instability. The vulnerability likely exists in the native C/C++ code layer where ImageMagick's core processing occurs, as memory management in native code requires explicit deallocation that was evidently omitted or incorrectly implemented in affected code paths.

RemediationAI

Upgrade Android-ImageMagick7 to version 7.1.2-11 or later to resolve the memory leak vulnerability. The patch is available via the vendor's GitHub repository at https://github.com/MolotovCherry/Android-ImageMagick7/pull/191 and should be integrated into affected Android applications through dependency updates. Organizations should review their Android application dependencies and update the Android-ImageMagick7 library to the patched version, then rebuild and redeploy affected applications. As an interim mitigation until patching is complete, consider implementing rate limiting on image processing endpoints, enforcing strict file size limits for uploaded images, monitoring memory usage with automated alerting for abnormal consumption patterns, and implementing automatic service restarts when memory thresholds are reached to minimize service disruption. Additionally, restrict image processing functionality to authenticated users only if feasible, reducing the attack surface from anonymous network-based attackers.