CVE-2026-109964 in ImageMagick
Summary
by MITRE • 10/13/2026
ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in ImageMagick versions prior to 7.1.2-33 and 6.9.13-58 represents a critical security flaw within the PICT image format decoder, specifically located in the DecodeImage function found in coders/pict.c. This issue manifests as a heap buffer underwrite resulting from pointer arithmetic overflow on 32-bit system builds. The root cause lies in how the software calculates memory offsets when processing image data structures. When an attacker supplies a maliciously crafted PICT file with maximized values for row, column, and bytes-per-line parameters, the internal logic fails to correctly validate these inputs against allocated buffer boundaries. Instead of triggering a standard out-of-bounds write error that might be caught by higher-level checks, the arithmetic overflow causes the pointer calculation to wrap around or underflow, resulting in memory addresses pointing below the intended heap allocation region.
From a technical perspective, this flaw allows an attacker to bypass existing bounds checking mechanisms because the vulnerability exploits the specific behavior of signed integer arithmetic on 32-bit architectures. By carefully constructing input values that cause the calculated offset to become negative or significantly smaller than expected due to overflow conditions, the application writes data to memory locations immediately preceding the allocated heap buffer. This underwrite capability is particularly dangerous as it enables an attacker to write up to one hundred and twenty-eight controlled bytes into adjacent memory structures. These adjacent structures may contain critical metadata such as allocation headers, function pointers, or other sensitive control data that governs program execution flow.
The operational impact of this vulnerability is severe, encompassing both denial of service and arbitrary code execution scenarios. If the underwrite corrupts non-critical memory regions, it typically results in application crashes, leading to a denial of service for users relying on ImageMagick for image processing tasks. However, if the attacker successfully targets specific heap metadata or function pointers located just below the buffer, they can achieve remote code execution with the privileges of the user running the vulnerable software. This transforms what might appear as a simple parsing error into a high-severity exploit vector capable of compromising system integrity and confidentiality. The risk is amplified in environments where ImageMagick processes untrusted images from external sources without proper sandboxing or input validation layers.
This vulnerability aligns with Common Weakness Enumeration (CWE) categories such as CWE-124 Buffer Underwrite, which describes writing data below the bounds of a buffer, and CWE-682 Incorrect Calculation, referring to errors in arithmetic operations that lead to security vulnerabilities. In terms of attack patterns, this exploit technique is consistent with ATT&CK tactics involving Initial Exploitation and Defense Evasion, as it leverages memory corruption techniques to bypass standard protections like stack canaries or heap metadata checks. The specific use of pointer arithmetic overflow highlights the importance of rigorous input validation in low-level image processing libraries where manual memory management is prevalent.
Mitigation strategies primarily involve upgrading ImageMagick to version 7.1.2-33 or later, and for legacy systems requiring the 6.x branch, updating to version 6.9.13-58 or higher. These releases contain patches that correct the pointer arithmetic logic and enforce stricter bounds checking before memory writes occur. In addition to software updates, organizations should implement input validation at network ingress points if ImageMagick is exposed via web services. Utilizing sandboxing techniques such as containerization can further limit the blast radius of any potential exploitation attempts by restricting file system access and resource consumption. Regular security audits focusing on image processing pipelines are recommended to ensure that no other similar vulnerabilities exist in custom integrations or older unsupported versions still in production environments.