CVE-2026-116142: ImageMagick before 7.1.2-33 Heap Buffer Over-Read via Minimum-Bounding-Box

Q: Which deployments are exposed to this issue?

Deployments using ImageMagick versions earlier than 7.1.2-33 are affected when they process attacker-supplied images and generate minimum-bounding-box output.

Q: What does an attacker need to exploit it?

An attacker needs to provide a crafted image and have it processed in a workflow that prints a minimum bounding box. The vector is local and user interaction is required according to the supplied severity vector.

Q: What is the likely impact of successful exploitation?

The over-read can cause a crash or disclose adjacent heap memory. The supplied vector rates confidentiality impact as low and indicates no integrity or availability impact.

Q: What can be done if upgrading is not immediately possible?

Avoid generating minimum-bounding-box output for untrusted images, or prevent untrusted images from reaching ImageMagick workflows that use this output mode.

Published Oct 25, 2026

Updated

ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printing a minimum-bounding-box. Attackers can supply a crafted image that triggers the over-read during minimum-bounding-box output, causing crashes or exposing adjacent heap memory.

Affected Software

1 affected component

ImageMagick ImageMagick<7.1.2-33

Event History

Oct 25, 2026

CVE Published

via MITRE·01:19 PM

Data Sourced

via MITRE·01:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using ImageMagick versions earlier than 7.1.2-33 are affected when they process attacker-supplied images and generate minimum-bounding-box output.

What does an attacker need to exploit it?

An attacker needs to provide a crafted image and have it processed in a workflow that prints a minimum bounding box. The vector is local and user interaction is required according to the supplied severity vector.

What is the likely impact of successful exploitation?

The over-read can cause a crash or disclose adjacent heap memory. The supplied vector rates confidentiality impact as low and indicates no integrity or availability impact.

What can be done if upgrading is not immediately possible?

Avoid generating minimum-bounding-box output for untrusted images, or prevent untrusted images from reaching ImageMagick workflows that use this output mode.

CVE-2026-116142: ImageMagick before 7.1.2-33 Heap Buffer Over-Read via Minimum-Bounding-Box

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of successful exploitation?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of successful exploitation?

What can be done if upgrading is not immediately possible?