CVE-2026-62363
Received Received - Intake

Heap Buffer Overwrite in ImageMagick

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, a heap buffer over-write can occur in the fx operation by passing a crafted argument. This issue has been fixed in version 7.1.2-27.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-07-30
AI Q&A
2026-07-30
EPSS Evaluated
N/A
NVD
CVE-2026-62363
EUVD
EUVD-2026-50573

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
imagemagick imagemagick to 7.1.2-27 (exc)
image_magick image_magick to 7.1.2-27 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

A heap buffer over-write vulnerability exists in ImageMagick's fx operation when processing a crafted argument. This flaw allows data to be written outside the intended buffer boundaries, potentially causing system crashes or instability.

Detection Guidance

To detect this vulnerability, check the installed version of ImageMagick using the command: convert --version or magick --version. If the version is prior to 7.1.2-27, the system is vulnerable. Additionally, monitor for crashes or unusual behavior during image processing operations, particularly with the fx command.

Impact Analysis

This vulnerability can lead to denial-of-service conditions, making affected systems unresponsive. It requires local access and user interaction to exploit, so it is not easily remotely exploitable.

Mitigation Strategies

Immediately update ImageMagick to version 7.1.2-27 or later. If updating is not possible, disable the fx operation or restrict access to ImageMagick for untrusted users. Apply input validation for image processing operations to prevent crafted arguments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62363. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart