CVE-2026-33900

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-33900
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the viff encoder contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out of bounds heap write, potentially causing a crash. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.

5.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/ImageMagick/ImageMagick/commit/d27b840a61b322419a66d0d192ff56d52498148d Patch
https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19 Release Notes
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v67w-737x-v2c9 Vendor Advisory
https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0 Release Notes
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
History

17 Apr 2026, 21:19

Type Values Removed Values Added
First Time Imagemagick
Imagemagick imagemagick
References () https://github.com/ImageMagick/ImageMagick/commit/d27b840a61b322419a66d0d192ff56d52498148d - () https://github.com/ImageMagick/ImageMagick/commit/d27b840a61b322419a66d0d192ff56d52498148d - Patch
References () https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19 - () https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19 - Release Notes
References () https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v67w-737x-v2c9 - () https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v67w-737x-v2c9 - Vendor Advisory
References () https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0 - () https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0 - Release Notes
CPE cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*

13 Apr 2026, 22:16

Type Values Removed Values Added
Summary (en) ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-189 and 6.9.13-44, the viff encoder contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out of bounds heap write, potentially causing a crash. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19. (en) ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the viff encoder contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out of bounds heap write, potentially causing a crash. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.

13 Apr 2026, 21:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-13 21:16

Updated : 2026-04-17 21:19

NVD link : CVE-2026-33900

Mitre link : CVE-2026-33900

CVE.ORG link : CVE-2026-33900

JSON object : View

Products Affected

imagemagick

  • imagemagick
CWE
CWE-190

Integer Overflow or Wraparound