Live › vulnerability › CVE-2026-119124
ImageMagick before 7.1.2-34 has a heap-based buffer overflow in its -morph option, where a crafted image causes writes past the end of a heap buffer. An attacker who supplies such an image to a user running -morph can corrupt heap memory and crash the application.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Systems that run ImageMagick and use the -morph option on images from untrusted sources can be crashed or have heap memory corrupted. Installations that never run -morph on external input are not exposed by this description. The sources do not say whether code execution is possible.
No product ranges from the sources yet.
magick -version and compare the version against the fixed release in the sources.-morph option on untrusted images (unknown if the sources list other paths).7.1.2-34 or later (per the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the application.
This page as .md · .json · in your agent: get_signal("CVE-2026-119124")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.