CVE-2026-116153: ImageMagick before 7.1.2-33 Heap Buffer Overflow via Convex-Hull on 32-bit

Q: Which deployments are affected?

The issue affects ImageMagick versions before 7.1.2-33 running on 32-bit systems. The provided information does not establish that 64-bit deployments are affected.

Q: What must an attacker be able to do to trigger the flaw?

An attacker needs to provide a crafted image that is processed with convex-hull calculations. The CVSS vector indicates local attack vector, high attack complexity, no privileges required, and user interaction required.

Q: What is the practical impact of successful exploitation?

A crafted image can overwrite heap memory, causing a crash or potentially enabling code execution. The listed CVSS impact indicates availability impact only, with no confidentiality or integrity impact scored.

Q: What version should be used for remediation?

Upgrade ImageMagick to version 7.1.2-33 or later. This vulnerability is described as affecting versions before 7.1.2-33.

Published Oct 25, 2026

Updated

ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory when convex-hull information is requested. Attackers can supply crafted images processed with convex-hull calculations to corrupt heap memory, causing crashes or potential code execution.

Affected Software

1 affected component

ImageMagick ImageMagick<7.1.2-33

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

The issue affects ImageMagick versions before 7.1.2-33 running on 32-bit systems. The provided information does not establish that 64-bit deployments are affected.

What must an attacker be able to do to trigger the flaw?

An attacker needs to provide a crafted image that is processed with convex-hull calculations. The CVSS vector indicates local attack vector, high attack complexity, no privileges required, and user interaction required.

What is the practical impact of successful exploitation?

A crafted image can overwrite heap memory, causing a crash or potentially enabling code execution. The listed CVSS impact indicates availability impact only, with no confidentiality or integrity impact scored.

What version should be used for remediation?

Upgrade ImageMagick to version 7.1.2-33 or later. This vulnerability is described as affecting versions before 7.1.2-33.

CVE-2026-116153: ImageMagick before 7.1.2-33 Heap Buffer Overflow via Convex-Hull on 32-bit

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What must an attacker be able to do to trigger the flaw?

What is the practical impact of successful exploitation?

What version should be used for remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What must an attacker be able to do to trigger the flaw?

What is the practical impact of successful exploitation?

What version should be used for remediation?