CVE-2026-31853: ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

March 10, 2026 (updated March 19, 2026)

An overflow on 32-bit systems can cause a crash in the SFW decoder when processing extremely large images.

References

github.com/ImageMagick/ImageMagick
github.com/ImageMagick/ImageMagick/security/advisories/GHSA-56jp-jfqg-f8f4
github.com/advisories/GHSA-56jp-jfqg-f8f4
github.com/dlemstra/Magick.NET/releases/tag/14.10.4
nvd.nist.gov/vuln/detail/CVE-2026-31853

Code Behaviors & Features

Detect and mitigate CVE-2026-31853 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →