CVE-2026-32636

CWE-787 — Out-of-bounds Write9 documents8 sources
Severity
7.5HIGH
EPSS
0.0%
top 95.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Imagemagick Imagemagick
Timeline
PublishedMar 18
Latest updateMar 30

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages22 packages

▶CVEListV5imagemagick/imagemagick< 7.1.2-17+1
▶NVDimagemagick/imagemagick7.0.0-0 — 7.1.2-17+1
▶NuGetMagick.NET-Q8-OpenMP-x64< 14.11.0
▶NuGetMagick.NET-Q16-OpenMP-x64< 14.11.0
▶NuGetMagick.NET-Q16-OpenMP-x86< 14.11.0

🔴Vulnerability Details

4
CVEList
ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash↗2026-03-18
▶
OSV
CVE-2026-32636: ImageMagick is free and open-source software used for editing and manipulating digital images↗2026-03-18
▶
GHSA
ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash↗2026-03-17
▶
OSV
ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash↗2026-03-17
▶

📋Vendor Advisories

3
Ubuntu
ImageMagick vulnerabilities↗2026-03-30
▶
Red Hat
ImageMagick: ImageMagick: Denial of Service via out-of-bounds write in NewXMLTree method↗2026-03-18
▶
Debian
CVE-2026-32636: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-32636 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶