CVE-2026-109964— ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder
Quick assessment
Affected
ImageMagick ImageMagick
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 32 位构建版本中，ImageMagick 7.1.2-33 之前版本以及 6.9.13-58 之前版本存在一个堆缓冲区下溢漏洞（heap buffer underwrite vulnerability）。该漏洞位于 文件中的 函数，由指针算术溢出引起。攻击者可通过构造恶意 PICT 文件，将行、列和每行字节数（bytes-per-line）值最大化，从而绕过边界检查，在堆缓冲区下方写入最多 128 个可控字节，导致程序崩溃或任意代码执行。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| ImageMagick | ImageMagick | 7.0.0-0< 7.1.2-33 |
affected |
< 6.9.13-58 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109964
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder
Source: CVE Program / CVE List V5
Vulnerability Description
ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
缓冲区下溢
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ImageMagick | ImageMagick | 7.0.0-0 ~ 7.1.2-33 | - |
|
II. Public POCs for CVE-2026-109964
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109964
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-109964 (2)
Vendor Advisories for CVE-2026-109964 (1)
Other References for CVE-2026-109964 (1)
IV. Related Vulnerabilities
Same product: ImageMagick
-
CVE-2026-109282
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefin -
CVE-2026-109281
ImageMagick 7.1.0-21 before 7.1.2-32 Heap Buffer Over-Read v -
CVE-2026-109280
ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx -
CVE-2026-109279
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Bu -
CVE-2026-109278
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory
Same vendor: ImageMagick
-
CVE-2026-109282
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefin -
CVE-2026-109281
ImageMagick 7.1.0-21 before 7.1.2-32 Heap Buffer Over-Read v -
CVE-2026-109280
ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx -
CVE-2026-109279
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Bu -
CVE-2026-109278
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory
Same weakness: CWE-124
-
CVE-2026-97008
Microsoft Office Excel Remote Code Execution Vulnerability -
CVE-2026-16179
IBM DataPower Gateway Buffer Underwrite -
CVE-2026-40013
Open-Xchange Dovecot Pro 缓冲区错误漏洞 -
CVE-2026-73075
Vim: Out-of-bounds Access in Popup Opacity Handling -
CVE-2026-16439
Eclipse OpenJ9 : Using -Xtrace to trace method arguments can
V. Comments for CVE-2026-109964
No comments yet