Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 6.9.13-56 and 7.1.2-31, a crafted local call to the GetVirtualPixels API can trigger an integer calculation error and write beyond a heap buffer, crashing the server process. This issue is fixed in versions 6.9.13-56 and 7.1.2-31.
Published: 2026-10-07
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via crash
Action: Apply Patch
AI Analysis

Impact

A crafted call to the GetVirtualPixels API performs an integer calculation that results in a heap buffer over-write, causing the ImageMagick server process to crash. The flaw is triggered by local input and leads to loss of when the service is overwhelmed with such inputs. The underlying weakness involves an integer overflow (CWE-190) that leads to a heap buffer over-write (CWE-787).

Affected Systems

The vulnerability affects the ImageMagick software suite prior to version 6.9.13-56 and 7.1.2-31. All deployments of ImageMagick below those releases are susceptible.

Risk and Exploitability

With a CVSS score of 5.1, the severity is moderate. No EPSS score is available and the vulnerability is not listed in CISA KEV, suggesting a lower current exploitation footprint. The attack vector is inferred to be local, requiring an attacker to engage the affected API from within the host or through a potentially compromised service that uses ImageMagick to process images.

Generated by OpenCVE AI on October 7, 2026 at 18:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ImageMagick to version 6.9.13-56 or later, or version 7.1.2-31 or later, to eliminate the integer overflow and buffer over-write flaw.
  • Remove or disable older ImageMagick installations from the environment to prevent accidental use of vulnerable code.
  • Configure any image processing services that use ImageMagick to run as an unprivileged user and isolate them from critical system processes to contain the impact of a crash.

Generated by OpenCVE AI on October 7, 2026 at 18:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4858-1 imagemagick security update
History

Wed, 21 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 07 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Imagemagick
Imagemagick imagemagick
Vendors & Products Imagemagick
Imagemagick imagemagick

Wed, 07 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 6.9.13-56 and 7.1.2-31, a crafted local call to the GetVirtualPixels API can trigger an integer calculation error and write beyond a heap buffer, crashing the server process. This issue is fixed in versions 6.9.13-56 and 7.1.2-31.
Title ImageMagick: Heap Buffer Over-Write in GetVirtualPixels api will result in a crash
Weaknesses CWE-190
CWE-787
References
Metrics cvssV3_1

{'score': 5.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Imagemagick Imagemagick
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-07T17:04:01.204Z

Reserved: 2026-10-06T20:31:59.017Z

Link: CVE-2026-106571

cve-icon Vulnrichment

Updated: 2026-10-07T16:09:47.533Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-07T16:17:42.863

Modified: 2026-10-21T18:31:50.510

Link: CVE-2026-106571

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-07T15:28:50Z

Links: CVE-2026-106571 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T18:30:14Z

Weaknesses