Vulnerability · Published Apr 13, 2026 · Assigned by GitHub_M
CVE-2026-33901ImageMagick has a Heap Buffer Overflow via MVG decoder
High 7.5
In plain English
A high-severity heap buffer overflow in ImageMagick from ImageMagick. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | imagemagick | 7.1.2.19-r0 | ALPINE-CVE-2026-33901 |
| Alpine:v3.24 | imagemagick | 7.1.2.19-r0 | ALPINE-CVE-2026-33901 |
| Debian:12 | imagemagick | 8:6.9.11.60+dfsg-1.6+deb12u9 | DEBIAN-CVE-2026-33901 |
| Debian:13 | imagemagick | 8:7.1.1.43+dfsg1-1+deb13u8 | DEBIAN-CVE-2026-33901 |
| Debian:14 | imagemagick | 8:7.1.2.19+dfsg1-1 | DEBIAN-CVE-2026-33901 |
| NuGet | magick.net-q16-anycpu | 14.12.0 | GHSA-x9h5-r9v2-vcww |
| NuGet | magick.net-q16-arm64 | 14.12.0 | GHSA-x9h5-r9v2-vcww |
| NuGet | magick.net-q16-hdri-anycpu | 14.12.0 | GHSA-x9h5-r9v2-vcww |
| NuGet | magick.net-q16-hdri-arm64 | 14.12.0 | GHSA-x9h5-r9v2-vcww |
| NuGet | magick.net-q16-hdri-openmp-arm64 | 14.12.0 | GHSA-x9h5-r9v2-vcww |
| NuGet | magick.net-q16-hdri-x64 | 14.12.0 | GHSA-x9h5-r9v2-vcww |
| NuGet | magick.net-q16-hdri-x86 | 14.12.0 | GHSA-x9h5-r9v2-vcww |
| NuGet | magick.net-q16-openmp-arm64 | 14.12.0 | GHSA-x9h5-r9v2-vcww |
| NuGet | magick.net-q16-openmp-x64 | 14.12.0 | GHSA-x9h5-r9v2-vcww |
| NuGet | magick.net-q16-x64 | 14.12.0 | GHSA-x9h5-r9v2-vcww |
| NuGet | magick.net-q16-x86 | 14.12.0 | GHSA-x9h5-r9v2-vcww |
| NuGet | magick.net-q8-anycpu | 14.12.0 | GHSA-x9h5-r9v2-vcww |
| NuGet | magick.net-q8-arm64 | 14.12.0 | GHSA-x9h5-r9v2-vcww |
| NuGet | magick.net-q8-openmp-arm64 | 14.12.0 | GHSA-x9h5-r9v2-vcww |
| NuGet | magick.net-q8-openmp-x64 | 14.12.0 | GHSA-x9h5-r9v2-vcww |
| NuGet | magick.net-q8-x64 | 14.12.0 | GHSA-x9h5-r9v2-vcww |
| NuGet | magick.net-q8-x86 | 14.12.0 | GHSA-x9h5-r9v2-vcww |
| Ubuntu:25.10 | imagemagick | no fix listed | UBUNTU-CVE-2026-33901 |
| Ubuntu:26.10 | imagemagick | no fix listed | UBUNTU-CVE-2026-33901 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ImageMagick | ImageMagick | < 7.1.2-19< 6.9.13-44 |
Weakness: CWE-122, CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x9h5-r9v2-vcww x_refsource_CONFIRM
- https://github.com/ImageMagick/ImageMagick/commit/4c72003e9e54a4ebaa938d239e75f5d285527ebe x_refsource_MISC
- https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0 x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-33901 vdb-entry, x_refsource_REDHAT
- RHBZ#2458023 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33901.json x_sadp-csaf-vex