CVE-2026-116153— ImageMagick before 7.1.2-33 Heap Buffer Overflow via Convex-Hull on 32-bit
Quick assessment
Affected
ImageMagick ImageMagick
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ImageMagick 7.1.2-33 之前的版本在 32 位系统上存在堆缓冲区溢出漏洞。当请求凸包（convex-hull）信息时，攻击者可利用该漏洞覆盖堆内存。攻击者可通过提供经过凸包计算处理的特制图像来破坏堆内存，从而导致程序崩溃或潜在的执行任意代码。
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-116153
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ImageMagick before 7.1.2-33 Heap Buffer Overflow via Convex-Hull on 32-bit
Source: CVE Program / CVE List V5
Vulnerability Description
ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory when convex-hull information is requested. Attackers can supply crafted images processed with convex-hull calculations to corrupt heap memory, causing crashes or potential code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ImageMagick | ImageMagick | 0 ~ 7.1.2-33 | - |
|
II. Public POCs for CVE-2026-116153
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-116153
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-116153 (2)
Same Patch Batch · ImageMagick · 2026-10-25 · 21 CVEs total
| CVE-2026-116149 | 8.1 HIGH | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compr |
| CVE-2026-116141 | 5.3 MEDIUM | ImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoder |
| CVE-2026-116154 | 5.3 MEDIUM | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via XML Parsing Depth Lim |
| CVE-2026-116155 | 5.3 MEDIUM | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via Crafted XMP Profile |
| CVE-2026-116152 | 5.3 MEDIUM | ImageMagick before 7.1.2-33 Memory Leak in MAT Decoder Error Path |
| CVE-2026-116145 | 3.9 LOW | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 Security Policy Bypass via Incomplete |
| CVE-2026-116151 | 3.7 LOW | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in JNG Encoder |
| CVE-2026-116147 | 3.7 LOW | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Null Pointer Dereference in DJVU Deco |
| CVE-2026-116146 | 3.7 LOW | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder |
| CVE-2026-116148 | 3.6 LOW | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawin |
| CVE-2026-116140 | 3.3 LOW | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass via Delegate Invocation |
| CVE-2026-116160 | 3.3 LOW | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 Animate |
| CVE-2026-116142 | 3.3 LOW | ImageMagick before 7.1.2-33 Heap Buffer Over-Read via Minimum-Bounding-Box |
| CVE-2026-116143 | 3.3 LOW | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass in PS, PDF and XPS Deco |
| CVE-2026-116144 | 3.3 LOW | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder |
| CVE-2026-116156 | 3.3 LOW | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -set profile Option |
| CVE-2026-116157 | 3.3 LOW | ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property Reading |
| CVE-2026-116159 | 3.3 LOW | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -cdl Option |
| CVE-2026-116150 | 3.1 LOW | ImageMagick before 7.1.2-33 Memory Leak in FPX Encoder |
| CVE-2026-116158 | 2.5 LOW | ImageMagick before 7.1.2-33 Memory Leak in magick compare |
IV. Related Vulnerabilities
Same product: ImageMagick
-
CVE-2026-116160
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Bu -
CVE-2026-116159
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory -
CVE-2026-116158
ImageMagick before 7.1.2-33 Memory Leak in magick compare -
CVE-2026-116157
ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Proper -
CVE-2026-116156
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory
Same vendor: ImageMagick
-
CVE-2026-116160
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Bu -
CVE-2026-116159
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory -
CVE-2026-116157
ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Proper -
CVE-2026-116158
ImageMagick before 7.1.2-33 Memory Leak in magick compare -
CVE-2026-116156
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory
Same weakness: CWE-190
-
CVE-2026-116188
rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via -
CVE-2026-116014
open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Ov -
CVE-2026-115505
libsmb2 before 6.3 Integer Overflow in DCE/RPC NDR Decoder v -
CVE-2026-115387
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 be -
CVE-2026-114645
Heap overflow via 32-bit length wrap of the URI username in