CVE-2026-116160

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 Animate

Published Oct 25, 2026 CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Description

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation when processing crafted images. Attackers can supply a malicious image that, when a user runs an X11 animate operation on it, overwrites heap memory and can crash the application.

Analysis

Technical impact

ImageMagick contains a heap-based buffer overflow in the X11 animate operation when handling crafted images. An attacker can supply a malicious image that, when processed by a user running an X11 animate operation, overwrites heap memory and can crash the application. The overflow does not provide direct remote code execution, but it can cause denial of service or potentially facilitate further exploitation if combined with other vulnerabilities.

Affected Systems

The flaw affects the ImageMagick software suite, specifically versions before 6.9.13-58 and before 7.1.2-33. Any installation of ImageMagick in those ranges on systems that use the X11 animate functionality is vulnerable.

Risk and Exploitability

The CVSS score of 4.8 indicates moderate severity. Because a suitable image can be crafted easily, the risk of accidental exploitation is high, inferred from the description. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local user or a process that invokes X11 animate on a malicious image; this inference is based on the description. An attacker could gain access by compromising a user session or by tricking a user into opening a malicious file.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ImageMagick

unaffected

Version	Status	Constraints
`7.0.0-0`	affected	< 7.1.2-33
`7.1.2-33`	unaffected	—

ImageMagick

unaffected

Version	Status	Constraints
`0`	affected	< 6.9.13-58
`6.9.13-58`	unaffected	—

Configuration 1 [-]

OR	cpe:2.3:a:imagemagick:imagemagick::::::::
	cpe:2.3:a:imagemagick:imagemagick::::::::

No data.

Vendor Product Versions

Imagemagick

Version	Status	Scheme	Platform
`[7.0.0-0,7.1.2-33)`	affected	semver	—
`7.1.2-33`	unaffected	semver	—

Imagemagick

Version	Status	Scheme	Platform
`[0,6.9.13-58)`	affected	generic	—
`6.9.13-58`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to ImageMagick version 6.9.13-58 or later, or 7.1.2-33 or later, which contain a fix for the X11 animate buffer overflow.
If an upgrade is not immediately possible, disable the X11 animate operation or restrict its use to trusted images to prevent heap corruption.
Apply any vendor-supplied memory protection options or runtime mitigations that reload or restrict the memory handling of the X11 animate feature.

Generated by OpenCVE AI on October 26, 2026 at 01:22 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4875-1	imagemagick security update

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.123% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6p6q-wfrv-ffhh
https://nvd.nist.gov/vuln/detail/CVE-2026-116160
https://www.cve.org/CVERecord?id=CVE-2026-116160
https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-heap-buffer-overflow-via-x11-animate

History

Nov 5, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 26, 2026 12:30 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2026-116160 https://www.cve.org/CVERecord?id=CVE-2026-116160
Metrics	threat_severity `None`	threat_severity `Low`

Oct 25, 2026 1:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation when processing crafted images. Attackers can supply a malicious image that, when a user runs an X11 animate operation on it, overwrites heap memory and can crash the application.
Title		ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 Animate
First Time appeared		Imagemagick Imagemagick imagemagick
Weaknesses		CWE-122
CPEs		cpe:2.3:a:imagemagick:imagemagick::::::::
Vendors & Products		Imagemagick Imagemagick imagemagick
References		https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6p6q-wfrv-ffhh https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-heap-buffer-overflow-via-x11-animate
Metrics		cvssV3_1 `{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`