CVE-2026-119124: ImageMagick before 7.1.2-34 Heap Buffer Overflow via -morph Option
ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in i ...
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.2.34+dfsg1-1
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must provide a crafted image and cause a user to process it with ImageMagick's -morph option. The reported vector requires user interaction and is rated as local access.
Which deployments are exposed?
Deployments using ImageMagick versions before 7.1.2-34 are affected when they process attacker-controlled images with the -morph option. The listed software package is debian/imagemagick.
What can be done until an update is available?
Avoid processing untrusted images with the -morph option until ImageMagick is updated to 7.1.2-34 or later. The documented outcome is heap corruption that can crash the application.