Live › vulnerability › CVE-2026-116142
Go to dashboardImageMagick before 7.1.2-33 reads past the end of a heap buffer when printing a minimum-bounding-box for a crafted image. An attacker who supplies such an image can crash the process or expose nearby heap memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Systems that run ImageMagick builds older than 7.1.2-33 on images supplied by outside users, such as upload or thumbnail services. Sources do not say which command paths reach the flawed bounding-box output, so internal-only use of trusted files is lower risk. unknown whether other ImageMagick entry points are affected.
No product ranges from the sources yet.
magick -version and compare against 7.1.2-337.1.2-33 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printing a minimum-bounding-box. Attackers can supply a crafted image that triggers the over-read during minimum-bounding-box output, causing crashes or exposing adjacent heap memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-116142")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.