CVE-2026-119123: ImageMagick before 7.1.2-34 Stack Overflow in TIFF Decoder

Q: Which deployments are affected by this issue?

ImageMagick versions before 7.1.2-34 are affected when the DNG decoder is disabled. The issue is in TIFF image decoding.

Q: What does an attacker need to exploit the vulnerability?

An attacker needs to provide a crafted image file to an application that processes it with the affected ImageMagick TIFF decoder. No authentication or user interaction is required according to the supplied vector.

Q: What is the expected impact of successful exploitation?

Successful exploitation can crash the application processing the crafted image, resulting in denial of service. The provided information does not indicate confidentiality or integrity impact.

Q: What should be done if an immediate upgrade is not possible?

Avoid processing untrusted TIFF image files in configurations where the DNG decoder is disabled until ImageMagick can be updated to 7.1.2-34 or later.

Published Oct 29, 2026

Updated

ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in ...

Affected Software

4 affected componentsFixes available

debian/imagemagick*

debian/imagemagick<8:7.1.2.34+dfsg1-1

8:7.1.2.34+dfsg1-1

debian/imagemagick<=8:6.9.11.60+dfsg-1.6+deb12u11, <=8:6.9.11.60+dfsg-1.6+deb12u14, <=8:7.1.1.43+dfsg1-1+deb13u12, <=8:7.1.1.43+dfsg1-1+deb13u13

8:7.1.2.34+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:7.1.2.34+dfsg1-1
Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 7.1.2-34

Event History

Oct 29, 2026

CVE Published

via MITRE·03:58 PM

Data Sourced

via MITRE·03:58 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:18 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·04:18 PM

Affected Software

Frequently Asked Questions

Which deployments are affected by this issue?

ImageMagick versions before 7.1.2-34 are affected when the DNG decoder is disabled. The issue is in TIFF image decoding.

What does an attacker need to exploit the vulnerability?

An attacker needs to provide a crafted image file to an application that processes it with the affected ImageMagick TIFF decoder. No authentication or user interaction is required according to the supplied vector.

What is the expected impact of successful exploitation?

Successful exploitation can crash the application processing the crafted image, resulting in denial of service. The provided information does not indicate confidentiality or integrity impact.

What should be done if an immediate upgrade is not possible?

Avoid processing untrusted TIFF image files in configurations where the DNG decoder is disabled until ImageMagick can be updated to 7.1.2-34 or later.

CVE-2026-119123: ImageMagick before 7.1.2-34 Stack Overflow in TIFF Decoder

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected by this issue?

What does an attacker need to exploit the vulnerability?

What is the expected impact of successful exploitation?

What should be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected by this issue?

What does an attacker need to exploit the vulnerability?

What is the expected impact of successful exploitation?

What should be done if an immediate upgrade is not possible?