Description
ImageMagick before 7.1.2-31 contains a heap buffer overflow vulnerability that allows attackers to overwrite heap memory by making a crafted call to the GetVirtualPixels API. Attackers can trigger the out-of-bounds heap write through crafted input to crash the server, causing a denial of service.
Published: 2026-10-08
Score: 5.9 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Update Software
AI Analysis

Impact

A heap buffer overflow in ImageMagick occurs when the GetVirtualPixels API processes crafted input, allowing an attacker to overwrite heap memory. The out‐of‐bounds write can crash the server, leading to a denial of service. The vulnerability is classified as CWE-190, an integer overflow that results in a buffer overrun.

Affected Systems

ImageMagick releases prior to 7.1.2-31 are affected. Any system running these versions, on any supported platform, could be impacted if the API is exposed to untrusted input.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog. Attackers likely need to supply a malicious image or make a crafted API call, suggesting a remote or local exploitation vector inferred from the description. No public exploit is documented, but the impact remains a potential service disruption.

Generated by OpenCVE AI on October 8, 2026 at 15:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update ImageMagick to version 7.1.2-31 or later to eliminate the heap overflow.
  • If an update cannot be applied immediately, restrict the GetVirtualPixels API to trusted networks or limit image upload sources and sizes to reduce exposure.
  • Monitor application logs for abnormal GetVirtualPixels activities or repeated crashes that may indicate exploitation attempts.

Generated by OpenCVE AI on October 8, 2026 at 15:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 08 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
Description ImageMagick before 7.1.2-31 contains a heap buffer overflow vulnerability that allows attackers to overwrite heap memory by making a crafted call to the GetVirtualPixels API. Attackers can trigger the out-of-bounds heap write through crafted input to crash the server, causing a denial of service.
Title ImageMagick before 7.1.2-31 Heap Buffer Overflow via GetVirtualPixels API
First Time appeared Imagemagick
Imagemagick imagemagick
Weaknesses CWE-190
CPEs cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
Vendors & Products Imagemagick
Imagemagick imagemagick
References
Metrics cvssV3_1

{'score': 5.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 5.9, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Imagemagick Imagemagick
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-08T17:09:08.275Z

Reserved: 2026-10-05T10:56:23.833Z

Link: CVE-2026-105398

cve-icon Vulnrichment

Updated: 2026-10-08T17:08:59.849Z

cve-icon NVD

Status : Received

Published: 2026-10-08T15:17:32.787

Modified: 2026-10-08T17:17:12.123

Link: CVE-2026-105398

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T17:00:17Z

Weaknesses
  • CWE-190

    Integer Overflow or Wraparound