CVE-2026-106564: ImageMagick: Heap Buffer Over-Write in EXR decoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-32
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using ImageMagick versions before 7.1.2-32 are affected when they process EXR images. The supplied data identifies the impact as a process crash caused by a crafted image.
What does an attacker need to exploit it?
An attacker needs to provide a crafted EXR image that is processed by the vulnerable ImageMagick EXR decoder. No privileges or user interaction are required according to the supplied vector.
Are confidentiality or integrity impacts reported?
No. The reported vector specifies no confidentiality or integrity impact; the stated impact is low availability impact through a process crash.
What should be done if systems are vulnerable?
Update ImageMagick to version 7.1.2-32, which fixes the issue. Until updating is possible, avoid processing untrusted EXR images.