CVE-2026-33535
Out-of-Bounds Write in ImageMagick X11 Display Causes Crash
Publication date: 2026-03-26
Last updated on: 2026-04-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| imagemagick | imagemagick | to 6.9.13-43 (exc) |
| imagemagick | imagemagick | From 7.0.0-0 (inc) to 7.1.2-18 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-33535 is a moderate severity vulnerability in ImageMagick, a software used for editing and manipulating digital images. The issue is an out-of-bounds write of a zero byte in the X11 display interaction code path. This means that the software writes data outside the allocated memory buffer, which can lead to a crash.
How can this vulnerability impact me? :
This vulnerability can cause ImageMagick to crash due to the out-of-bounds write. The impact is limited to availability, meaning the software may become unavailable or stop functioning properly. There is no impact on confidentiality or integrity of data.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update ImageMagick to a patched version.
- Upgrade to ImageMagick version 7.1.2-18 or later.
- Alternatively, upgrade to version 6.9.13-43 or later if using the 6.x branch.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability in ImageMagick involves an out-of-bounds write that can cause a crash, impacting availability but not confidentiality or integrity.
Since the vulnerability does not affect confidentiality or integrity of data, it is unlikely to directly impact compliance with standards such as GDPR or HIPAA, which primarily focus on protecting personal data privacy and integrity.
However, the availability impact could affect system reliability, which may be a consideration in some regulatory contexts, but no direct compliance violation is indicated.