OESA-2026-1920 (CVE-2026-33899)

Vulnerability from osv_openeuler – Published: 2026-04-17 11:10 – Updated: 2026-08-06 11:10 – Source website
VLAI
Summary
ImageMagick security update
Details

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick contains a heap buffer overflow vulnerability when parsing XML. An attacker can exploit this vulnerability to write a single zero byte to a heap buffer, potentially leading to memory corruption or remote code execution.(CVE-2026-33899)

The VIFF encoder in ImageMagick contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out of bounds heap write that can result in a crash.(CVE-2026-33900)

ImageMagick is an open-source image processing software. A heap buffer overflow vulnerability exists in the MVG (Magick Vector Graphics) decoder of ImageMagick. Attackers can trigger this vulnerability through specially crafted MVG image files, which may lead to arbitrary code execution.(CVE-2026-33901)

ImageMagick is vulnerable to stack overflow when processing recursive FX expressions. An attacker can cause stack overflow through specially crafted FX expressions, potentially leading to denial of service or arbitrary code execution.(CVE-2026-33902)

ImageMagick has an out-of-bounds read vulnerability in the sample operation. Attackers can exploit this vulnerability to read memory data beyond allocated boundaries, which may lead to information disclosure or application crashes.(CVE-2026-33905)

The DestroyXMLTree function in ImageMagick contains an uncontrolled recursion vulnerability (CWE-674). An attacker can trigger a stack overflow via specially crafted XML files, potentially leading to denial of service or arbitrary code execution. This vulnerability affects all versions prior to ImageMagick 7.1.2-19 and all versions prior to 6.9.13-44.(CVE-2026-33908)

A heap out-of-bounds write vulnerability exists in the JP2 encoder of ImageMagick. Attackers could exploit this vulnerability by crafting malicious JP2 image files, leading to heap memory corruption that could potentially execute arbitrary code or cause application crashes.(CVE-2026-40310)

A heap-use-after-free vulnerability exists in ImageMagick when processing XMP profile data. This vulnerability could be exploited by an attacker to cause a crash or potentially execute arbitrary code when printing values from the XMP profile.(CVE-2026-40311)

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "ImageMagick-6.9.13.44-1.oe2003sp4.aarch64.rpm",
          "ImageMagick-c++-6.9.13.44-1.oe2003sp4.aarch64.rpm",
          "ImageMagick-c++-devel-6.9.13.44-1.oe2003sp4.aarch64.rpm",
          "ImageMagick-debuginfo-6.9.13.44-1.oe2003sp4.aarch64.rpm",
          "ImageMagick-debugsource-6.9.13.44-1.oe2003sp4.aarch64.rpm",
          "ImageMagick-devel-6.9.13.44-1.oe2003sp4.aarch64.rpm",
          "ImageMagick-perl-6.9.13.44-1.oe2003sp4.aarch64.rpm"
        ],
        "noarch": [
          "ImageMagick-help-6.9.13.44-1.oe2003sp4.noarch.rpm"
        ],
        "src": [
          "ImageMagick-6.9.13.44-1.oe2003sp4.src.rpm"
        ],
        "x86_64": [
          "ImageMagick-6.9.13.44-1.oe2003sp4.x86_64.rpm",
          "ImageMagick-c++-6.9.13.44-1.oe2003sp4.x86_64.rpm",
          "ImageMagick-c++-devel-6.9.13.44-1.oe2003sp4.x86_64.rpm",
          "ImageMagick-debuginfo-6.9.13.44-1.oe2003sp4.x86_64.rpm",
          "ImageMagick-debugsource-6.9.13.44-1.oe2003sp4.x86_64.rpm",
          "ImageMagick-devel-6.9.13.44-1.oe2003sp4.x86_64.rpm",
          "ImageMagick-perl-6.9.13.44-1.oe2003sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP4",
        "name": "ImageMagick",
        "purl": "pkg:rpm/openEuler/ImageMagick\u0026distro=openEuler-20.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.9.13.44-1.oe2003sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and B\u00e9zier curves.\r\n\r\nSecurity Fix(es):\n\nImageMagick contains a heap buffer overflow vulnerability when parsing XML. An attacker can exploit this vulnerability to write a single zero byte to a heap buffer, potentially leading to memory corruption or remote code execution.(CVE-2026-33899)\n\nThe VIFF encoder in ImageMagick contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out of bounds heap write that can result in a crash.(CVE-2026-33900)\n\nImageMagick is an open-source image processing software. A heap buffer overflow vulnerability exists in the MVG (Magick Vector Graphics) decoder of ImageMagick. Attackers can trigger this vulnerability through specially crafted MVG image files, which may lead to arbitrary code execution.(CVE-2026-33901)\n\nImageMagick is vulnerable to stack overflow when processing recursive FX expressions. An attacker can cause stack overflow through specially crafted FX expressions, potentially leading to denial of service or arbitrary code execution.(CVE-2026-33902)\n\nImageMagick has an out-of-bounds read vulnerability in the sample operation. Attackers can exploit this vulnerability to read memory data beyond allocated boundaries, which may lead to information disclosure or application crashes.(CVE-2026-33905)\n\nThe DestroyXMLTree function in ImageMagick contains an uncontrolled recursion vulnerability (CWE-674). An attacker can trigger a stack overflow via specially crafted XML files, potentially leading to denial of service or arbitrary code execution. This vulnerability affects all versions prior to ImageMagick 7.1.2-19 and all versions prior to 6.9.13-44.(CVE-2026-33908)\n\nA heap out-of-bounds write vulnerability exists in the JP2 encoder of ImageMagick. Attackers could exploit this vulnerability by crafting malicious JP2 image files, leading to heap memory corruption that could potentially execute arbitrary code or cause application crashes.(CVE-2026-40310)\n\nA heap-use-after-free vulnerability exists in ImageMagick when processing XMP profile data. This vulnerability could be exploited by an attacker to cause a crash or potentially execute arbitrary code when printing values from the XMP profile.(CVE-2026-40311)",
  "id": "OESA-2026-1920",
  "modified": "2026-08-06T11:10:56Z",
  "published": "2026-04-17T11:10:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1920"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33899"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33900"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33901"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33902"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33905"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33908"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40310"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40311"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ImageMagick security update",
  "upstream": [
    "CVE-2026-33899",
    "CVE-2026-33900",
    "CVE-2026-33901",
    "CVE-2026-33902",
    "CVE-2026-33905",
    "CVE-2026-33908",
    "CVE-2026-40310",
    "CVE-2026-40311"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.