CVE-2026-34238: ImageMagick has an integer overflow in despeckle operation causing a heap buffer overflow on 32-bit builds
(updated )
An integer overflow in the despeckle operation causes a heap buffer overflow on 32-bit builds that will result in an out of bounds write.
==1551685==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xea2fb818 at pc 0x56cbc42a bp 0xffc4ce48 sp 0xffc4ce38
WRITE of size 8 at 0xea2fb818 thread T0
References
- github.com/ImageMagick/ImageMagick/commit/bcd8519c70ecd9ebbc180920f2cf97b267d1f440
- github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19
- github.com/ImageMagick/ImageMagick/security/advisories/GHSA-26qp-ffjh-2x4v
- github.com/advisories/GHSA-26qp-ffjh-2x4v
- github.com/dlemstra/Magick.NET/releases/tag/14.12.0
- nvd.nist.gov/vuln/detail/CVE-2026-34238
Code Behaviors & Features
Detect and mitigate CVE-2026-34238 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →