Heap Buffer Underwrite in ImageMagick

Executive Summary

CVE-2026-109964 is a heap buffer underwrite vulnerability in ImageMagick's PICT decoder. It affects 32-bit builds of versions before 7.1.2-33 and 6.9.13-58. Attackers can exploit this by providing a crafted PICT file with large row, column, and bytes-per-line values to bypass bounds checks. This allows writing up to 128 controlled bytes below the heap buffer, potentially causing crashes or code execution.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed ImageMagick version using 'convert --version' or 'magick --version'. If the version is below 7.1.2-33 or 6.9.13-58, the system is vulnerable. Scan for PICT file processing errors in logs or use fuzz testing tools to identify crashes when processing malformed PICT files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to crashes or arbitrary code execution if exploited. Attackers can cause denial-of-service conditions or take control of affected systems by processing malicious PICT files. Systems running vulnerable 32-bit ImageMagick versions are at risk.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ImageMagick to version 7.1.2-33 or later for ImageMagick 7, or 6.9.13-58 or later for ImageMagick 6. Apply patches from the official ImageMagick repository if upgrading is not immediately possible. Avoid processing untrusted PICT files until the update is applied.

Useful 0 Not Useful 0