DEBIAN-CVE-2026-116160: Buffer Overflow

Q: Who is exposed to this issue?

Users of Debian ImageMagick who run the X11 animate operation on attacker-supplied or otherwise untrusted images are exposed. The issue requires local access and user interaction.

Q: What must an attacker do to trigger the vulnerability?

An attacker must provide a crafted image and persuade a user to process it using ImageMagick's X11 animate operation. Processing images through other operations is not identified as affected by the available information.

Q: What is the expected impact?

A successful exploit can overwrite heap memory and crash the application. The provided severity vector indicates no confidentiality or integrity impact and a low availability impact.

Q: Which ImageMagick versions are affected?

Affected versions are ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33.

Published Oct 25, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation when processing crafted images. Attackers can supply a malicious image that, when a user runs an X11 animate operation on it, overwrites heap memory and can crash the application.

Affected Software

3 affected componentsFixes available

debian/imagemagick*

debian/imagemagick<8:7.1.2.33+dfsg1-1

8:7.1.2.33+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:7.1.2.33+dfsg1-1

Event History

Oct 25, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Users of Debian ImageMagick who run the X11 animate operation on attacker-supplied or otherwise untrusted images are exposed. The issue requires local access and user interaction.

What must an attacker do to trigger the vulnerability?

An attacker must provide a crafted image and persuade a user to process it using ImageMagick's X11 animate operation. Processing images through other operations is not identified as affected by the available information.

What is the expected impact?

A successful exploit can overwrite heap memory and crash the application. The provided severity vector indicates no confidentiality or integrity impact and a low availability impact.

Which ImageMagick versions are affected?

Affected versions are ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33.

DEBIAN-CVE-2026-116160: Buffer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to trigger the vulnerability?

What is the expected impact?

Which ImageMagick versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to trigger the vulnerability?

What is the expected impact?

Which ImageMagick versions are affected?