CVE-2026-106574: ImageMagick: Heap Buffer Over-Write in distributed pixel cache server will result in a crash
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server. This issue is fixed in version 7.1.2-31.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-31
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments that run ImageMagick's distributed pixel cache server are exposed. The vulnerable server can be crashed by a connected client sending crafted pixel data.
What access does an attacker need to exploit it?
An attacker needs network access to connect to the distributed pixel cache server. No privileges or user interaction are required, but exploitation has high attack complexity.
What is the impact of successful exploitation?
Successful exploitation causes a heap buffer overwrite resulting from an integer-size calculation error and can crash the server. The provided severity vector indicates no confidentiality or integrity impact, with impact limited to availability.
How can this be remediated?
Upgrade ImageMagick to version 7.1.2-31 or later. Versions prior to 7.1.2-31 are affected.