Live › vulnerability › CVE-2026-119123
ImageMagick before 7.1.2-34 has a stack overflow in its TIFF decoder when the DNG decoder is disabled. An attacker who supplies a crafted image can crash the application, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Systems that run ImageMagick before 7.1.2-34 to process image files supplied from outside, such as user uploads, are exposed. The sources describe the flaw as occurring when the DNG decoder is disabled, so the configuration matters. Teams that only process trusted local images or run a newer version can skip it.
No product ranges from the sources yet.
magick -version and compare the version to 7.1.2-347.1.2-34 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image file for processing to trigger the stack overflow and crash the application, causing denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-119123")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.