{"id":"CVE-2026-116142","kind":"vulnerability","aliases":["CVE-2026-116142"],"related":[],"title":"ImageMagick: crafted image leaks adjacent heap memory during bounding-box output","description":"ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printing a minimum-bounding-box. Attackers can supply a crafted image that triggers the over-read during minimum-bounding-box output, causing crashes or exposing adjacent heap memory.","summary":"ImageMagick before 7.1.2-33 reads past the end of a heap buffer when printing a minimum-bounding-box for a crafted image. An attacker who supplies such an image can crash the process or expose nearby heap memory.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["image-processing","imagemagick","package","self-hosted"],"not_affected_if":["trusted-input-only","version-7.1.2-33-or-later"],"how_to_check":"- Run `magick -version` and compare against `7.1.2-33`\n- Check whether ImageMagick processes untrusted uploads with bounding-box output enabled (unknown whether the sources name a specific option)","fix":"- Upgrade ImageMagick to `7.1.2-33` or later\n- unknown whether a configuration workaround exists","status":"open","published_at":"2026-10-25T14:16:52+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","triaged_at":"2026-10-25T14:44:13+00:00","updated_at":"2026-10-25T14:44:13+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T14:44:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ImageMagick to `7.1.2-33` or later\n- unknown whether a configuration workaround exists","reach":"unknown","title":"ImageMagick: crafted image leaks adjacent heap memory during bounding-box output","impact":"medium","summary":"ImageMagick before 7.1.2-33 reads past the end of a heap buffer when printing a minimum-bounding-box for a crafted image. An attacker who supplies such an image can crash the process or expose nearby heap memory.","category":"package","nicknames":[],"who_cares":["imagemagick","self-hosted","image-processing"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Process crashes or adjacent heap memory is exposed to the attacker","analyst_note":"Confirm which ImageMagick commands and options reach the minimum-bounding-box output, and check the NVD entry for the affected version range and CVSS vector.","how_to_check":"- Run `magick -version` and compare against `7.1.2-33`\n- Check whether ImageMagick processes untrusted uploads with bounding-box output enabled (unknown whether the sources name a specific option)","needs_analyst":true,"not_affected_if":["version-7.1.2-33-or-later","trusted-input-only"],"who_is_affected":"Systems that run ImageMagick builds older than 7.1.2-33 on images supplied by outside users, such as upload or thumbnail services. Sources do not say which command paths reach the flawed bounding-box output, so internal-only use of trusted files is lower risk. unknown whether other ImageMagick entry points are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00063,"input_tokens":3336,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116142':15A,18A '-2026':14A,17A '-33':30B,69C '7.1.2':29B,68C 'adjac':5A,115C 'alloc':84C 'allow':79C 'attack':51B,80C,93C 'beyond':83C 'bound':10A,44B,91C,108C 'bounding-box':9A 'box':11A,45B,92C,109C 'buffer':38B,73C 'caus':111C 'contain':70C 'craft':2A,48B,97C 'crash':58B,112C 'cve':13A,16A 'end':34B 'expos':62B,114C 'heap':6A,37B,64B,72C,116C 'host':26B 'imag':3A,20B,49B,56B,98C 'image-process':19B 'imagemagick':1A,22B,27B,66C 'leak':4A 'memori':7A,65B,85C,117C 'minimum':43B,90C,107C 'minimum-bounding-box':42B,89C,106C 'nearbi':63B 'output':12A,110C 'over-read':74C,102C 'packag':23B 'past':32B 'print':40B,87C 'process':21B,60B 'read':31B,76C,82C,104C 'self':25B 'self-host':24B 'suppli':53B,95C 'trigger':100C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Systems that run ImageMagick builds older than 7.1.2-33 on images supplied by outside users, such as upload or thumbnail services. Sources do not say which command paths reach the flawed bounding-box output, so internal-only use of trusted files is lower risk. unknown whether other ImageMagick entry points are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116142","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116142","severity":null,"published_at":"2026-10-25T14:16:52+00:00","modified_at":"2026-10-25T14:16:52+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","fetched_at":"2026-10-25T14:41:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}