CVE-2026-116142
Received Received - Intake

Heap Buffer Over-read in ImageMagick

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printing a minimum-bounding-box. Attackers can supply a crafted image that triggers the over-read during minimum-bounding-box output, causing crashes or exposing adjacent heap memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116142
EUVD
EUVD-2026-109403

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ImageMagick ImageMagick 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ImageMagick before version 7.1.2-33 has a heap buffer over-read vulnerability (CVE-2026-116142). When printing a minimum-bounding-box, attackers can supply a crafted image that causes the software to read beyond allocated memory. This leads to crashes or exposure of adjacent heap memory.

Detection Guidance

To detect this vulnerability, check the installed version of ImageMagick using the command: identify -version. If the version is below 7.1.2-33, the system is vulnerable. Additionally, monitor for crashes or unusual memory access patterns when processing images.

Impact Analysis

This vulnerability can cause application crashes or allow attackers to access sensitive data in memory. It requires user interaction to trigger, meaning a victim must process a malicious image for the attack to succeed.

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA by potentially exposing sensitive data through heap memory leaks. If exploited, it could lead to unauthorized disclosure of personal or health information, violating confidentiality requirements under these regulations.

Mitigation Strategies

Immediately update ImageMagick to version 7.1.2-33 or later. If updating is not possible, restrict access to ImageMagick processing functions and avoid processing untrusted images until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116142. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart