CVE-2026-33900: ImageMagick has a heap overflow caused by integer overflow/wraparound in viff encoder on 32-bit builds
(updated )
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the viff encoder contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out of bounds heap write, potentially causing a crash. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.
References
- github.com/ImageMagick/ImageMagick/commit/d27b840a61b322419a66d0d192ff56d52498148d
- github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19
- github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v67w-737x-v2c9
- github.com/advisories/GHSA-v67w-737x-v2c9
- github.com/dlemstra/Magick.NET/releases/tag/14.12.0
- nvd.nist.gov/vuln/detail/CVE-2026-33900
Code Behaviors & Features
Detect and mitigate CVE-2026-33900 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →