CVE-2026-33899

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-33899
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-189 and 6.9.13-44, when `Magick` parses an XML file it is possible that a single zero byte is written out of the bounds. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/ImageMagick/ImageMagick/commit/ae679e2fd19ec656bfab9f822ae4cf06bf91604d Patch
https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19 Release Notes
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr67-pvmx-2pp2 Vendor Advisory
https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0 Release Notes
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
History

17 Apr 2026, 21:20

Type Values Removed Values Added
References () https://github.com/ImageMagick/ImageMagick/commit/ae679e2fd19ec656bfab9f822ae4cf06bf91604d - () https://github.com/ImageMagick/ImageMagick/commit/ae679e2fd19ec656bfab9f822ae4cf06bf91604d - Patch
References () https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19 - () https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19 - Release Notes
References () https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr67-pvmx-2pp2 - () https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr67-pvmx-2pp2 - Vendor Advisory
References () https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0 - () https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0 - Release Notes
CPE cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
First Time Imagemagick
Imagemagick imagemagick

13 Apr 2026, 21:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-13 21:16

Updated : 2026-04-17 21:20

NVD link : CVE-2026-33899

Mitre link : CVE-2026-33899

CVE.ORG link : CVE-2026-33899

JSON object : View

Products Affected

imagemagick

  • imagemagick
CWE
CWE-122

Heap-based Buffer Overflow

CWE-191

Integer Underflow (Wrap or Wraparound)