DEBIAN-CVE-2026-119124: Buffer Overflow
ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.2.34+dfsg1-1
Event History
Frequently Asked Questions
Which installations need to be remediated?
ImageMagick versions before 7.1.2-34 are affected. The listed software is Debian's imagemagick package.
What must occur for exploitation?
An attacker must provide a crafted image and have it processed by a user with the -morph option. The vulnerability has a user-interaction requirement in the supplied severity vector.
What is the expected impact?
Processing the crafted image can corrupt heap memory and crash the application. The supplied vector indicates availability impact only, with no confidentiality or integrity impact.
What can be done before updating?
Avoid processing untrusted images with the -morph option until ImageMagick is updated to 7.1.2-34 or later.