CVE-2026-30883: ImageMagick has a Heap Overflow when writing extremely large image profile in the PNG encoder
Published Mar 9, 2026
·Updated
An extremely large image profile could result in a heap overflow when encoding a PNG image.
Affected Software
20 affected componentsFixes available
ImageMagick ImageMagick<7.1.2-16, <6.9.13-41
nuget/Magick.NET-Q8-x86<14.10.4
14.10.4
nuget/Magick.NET-Q8-arm64<14.10.4
14.10.4
nuget/Magick.NET-Q8-OpenMP-x64<14.10.4
14.10.4
nuget/Magick.NET-Q8-OpenMP-arm64<14.10.4
14.10.4
nuget/Magick.NET-Q8-AnyCPU<14.10.4
14.10.4
nuget/Magick.NET-Q16-x86<14.10.4
14.10.4
nuget/Magick.NET-Q16-arm64<14.10.4
14.10.4
nuget/Magick.NET-Q16-OpenMP-x86<14.10.4
14.10.4
nuget/Magick.NET-Q16-OpenMP-x64<14.10.4
14.10.4
nuget/Magick.NET-Q16-OpenMP-arm64<14.10.4
14.10.4
nuget/Magick.NET-Q16-HDRI-x86<14.10.4
14.10.4
nuget/Magick.NET-Q16-HDRI-x64<14.10.4
14.10.4
nuget/Magick.NET-Q16-HDRI-arm64<14.10.4
14.10.4
nuget/Magick.NET-Q16-HDRI-OpenMP-x64<14.10.4
14.10.4
nuget/Magick.NET-Q16-HDRI-OpenMP-arm64<14.10.4
14.10.4
nuget/Magick.NET-Q16-HDRI-AnyCPU<14.10.4
14.10.4
nuget/Magick.NET-Q16-AnyCPU<14.10.4
14.10.4
ImageMagick ImageMagick<6.9.13-41
ImageMagick ImageMagick>=7.0.0-0<7.1.2-16
Event History
Mar 9, 2026
CVE Published
via MITRE·09:45 PM
Data Sourced
via MITRE·09:45 PM
DescriptionSeverityWeakness
Mar 10, 2026
Data Sourced
via NVD·07:44 AM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·09:05 PM
Data Sourced
via GitHub·09:05 PM
DescriptionSeverityWeaknessAffected Software
Aug 9, 58172
Event
via FIRST·06:32 PM
Frequently Asked Questions
1
What is the severity of CVE-2026-30883?
CVE-2026-30883 is classified as a high severity vulnerability due to its potential for causing a heap overflow.
2
How do I fix CVE-2026-30883?
To fix CVE-2026-30883, upgrade ImageMagick to version 7.1.2-16 or later, or 6.9.13-41 or later.
3
What products are affected by CVE-2026-30883?
CVE-2026-30883 affects ImageMagick versions prior to 7.1.2-16 and 6.9.13-41.
4
What can happen if CVE-2026-30883 is exploited?
Exploitation of CVE-2026-30883 may lead to denial of service or remote code execution due to heap overflow.
5
Is there a workaround for CVE-2026-30883?
There are no effective workarounds for CVE-2026-30883; updating to a patched version is recommended.