CVE-2026-33536

CWE-121 — Stack-based Buffer OverflowCWE-787 — Out-of-bounds WriteCWE-8238 documents7 sources
Severity
4.7MEDIUM
EPSS
0.0%
top 95.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Imagemagick Imagemagick
Timeline
PublishedMar 26

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-18 and 6.9.13-43, due to an incorrect return value on certain platforms a pointer is incremented past the end of a buffer that is on the stack and that could result in an out of bounds write. Versions 7.1.2-18 and 6.9.13-43 patch the issue.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 1.4 | Impact: 3.6

Affected Packages20 packages

▶CVEListV5imagemagick/imagemagick< 7.1.2-18+1
▶NVDimagemagick/imagemagick7.0.0-0 — 7.1.2-18+1
▶NuGetMagick.NET-Q8-OpenMP-x64< 14.11.1
▶NuGetMagick.NET-Q16-OpenMP-x64< 14.11.1
▶NuGetMagick.NET-Q16-OpenMP-x86< 14.11.1

🔴Vulnerability Details

4
CVEList
ImageMagick has an Out-of-bounds Write via InterpretImageFilename↗2026-03-26
▶
GHSA
ImageMagick has an Out-of-bounds Write via InterpretImageFilename↗2026-03-26
▶
OSV
CVE-2026-33536: ImageMagick is free and open-source software used for editing and manipulating digital images↗2026-03-26
▶
OSV
ImageMagick has an Out-of-bounds Write via InterpretImageFilename↗2026-03-26
▶

📋Vendor Advisories

2
Red Hat
ImageMagick: ImageMagick: Denial of Service via out-of-bounds write↗2026-03-26
▶
Debian
CVE-2026-33536: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-33536 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-33536 (MEDIUM CVSS 4.7) | ImageMagick is free and open-source | cvebase.io