Vulnerability in Imagemagick
CVE-2026-109964
ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.6 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqmp-r5jh-jx7w (vendor-advisory)
- github.com/ImageMagick/ImageMagick/commit/63dde0cf281383ab69432b88305f7dcd6a8ce… (patch)
- github.com/ImageMagick/ImageMagick6/commit/c18c5d5fb7f1d87ddbe0a02e9d1207c89b24… (patch)
- github.com/ImageMagick/ImageMagick/blob/7.1.2-32/coders/pict.c (technical-description)
- github.com/ImageMagick/ImageMagick (product)
- www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-and-6.9.13-58-heap-buf… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-109964?
- CVE-2026-109964 is a medium-severity vulnerability in Imagemagick, classified under Buffer Underwrite. CVSS score: 5.6/10. Published 2026-10-13.
- How severe is CVE-2026-109964?
- Medium severity. CVSS v3 base score is 5.6 out of 10.