CVE-2026-109964: ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder
ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
The issue affects 32-bit ImageMagick builds that process PICT files. Deployments that do not use 32-bit builds are not identified as affected by the provided information.
What does an attacker need to exploit this issue?
An attacker needs to provide a crafted PICT file with maximized row, column, and bytes-per-line values. The vector is network-accessible and does not require privileges or user interaction, although exploitation has high attack complexity.
How can I determine whether my installation is affected?
Check whether ImageMagick is running as a 32-bit build and whether its version predates 7.1.2-33 or 6.9.13-58. Also identify workflows that accept or decode PICT files, especially from untrusted sources.
What are the possible consequences of successful exploitation?
A crafted file can bypass bounds checks and write up to 128 attacker-controlled bytes below a heap buffer. This can cause crashes or potentially code execution, with low confidentiality, integrity, and availability impacts reflected in the supplied severity vector.