Live › vulnerability › CVE-2026-116160
Go to dashboardImageMagick's X11 animate operation has a heap-based buffer overflow when it processes a crafted image. An attacker who supplies such an image and gets a user to run animate on it can overwrite heap memory and crash the application.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Only installs before the fixed versions are exposed, and the flaw sits in the X11 animate path, so it matters mainly where users open untrusted images interactively on a desktop with X11. Servers that only convert or resize images in batch without invoking animate are unlikely to be exposed. unknown whether the sources list specific products or distributions.
No product ranges from the sources yet.
magick -version and compare against the fixed releases: 6.9.13-58 on the 6.x line and 7.1.2-33 on the 7.x line.magick -list configure or convert -list configure shows the X11 delegate.6.9.13-58 or later.7.1.2-33 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation when processing crafted images. Attackers can supply a malicious image that, when a user runs an X11 animate operation on it, overwrites heap memory and can crash the application.
This page as .md · .json · in your agent: get_signal("CVE-2026-116160")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.