DEBIAN-CVE-2026-116142: Medium severity debian/imagemagick vulnerability

Q: Who is exposed to this issue?

Systems using ImageMagick versions before 7.1.2-33 are affected when they process attacker-supplied images and generate minimum-bounding-box output. The provided vector indicates local attack access and user interaction are required.

Q: What does an attacker need to do to trigger the vulnerability?

An attacker must provide a crafted image that is processed in a way that prints its minimum bounding box. Triggering the issue can cause a crash or disclose adjacent heap memory.

Q: How can I determine whether a system is affected?

Check the installed ImageMagick version. Versions earlier than 7.1.2-33 are affected according to the provided information.

Published Oct 25, 2026

Updated

ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printing a minimum-bounding-box. Attackers can supply a crafted image that triggers the over-read during minimum-bounding-box output, causing crashes or exposing adjacent heap memory.

Affected Software

3 affected componentsFixes available

debian/imagemagick*

debian/imagemagick<8:7.1.2.33+dfsg1-1

8:7.1.2.33+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:7.1.2.33+dfsg1-1

Event History

Oct 25, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems using ImageMagick versions before 7.1.2-33 are affected when they process attacker-supplied images and generate minimum-bounding-box output. The provided vector indicates local attack access and user interaction are required.

What does an attacker need to do to trigger the vulnerability?

An attacker must provide a crafted image that is processed in a way that prints its minimum bounding box. Triggering the issue can cause a crash or disclose adjacent heap memory.

How can I determine whether a system is affected?

Check the installed ImageMagick version. Versions earlier than 7.1.2-33 are affected according to the provided information.

DEBIAN-CVE-2026-116142: Medium severity debian/imagemagick vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the vulnerability?

How can I determine whether a system is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the vulnerability?

How can I determine whether a system is affected?