CVE-2026-109964

5.6Medium

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

5.6Medium

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-124

Impact

Remote attackers can crash the process or execute code by providing a malicious PICT image file. Exploitation requires processing untrusted PICT files on a 32-bit build.

Root cause

A pointer arithmetic overflow in DecodeImage() within coders/pict.c allows out-of-bounds heap writes below the buffer when parsing crafted row, column, and bytes-per-line values.

Affected systems

ImageMagick before 7.1.2-33 and before 6.9.13-58 on 32-bit builds.

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Fix & remediation

Upgrade ImageMagick to version 7.1.2-33, 6.9.13-58, or later. If upgrading is delayed, disable the PICT coder in policy.xml by adding <policy domain="coder" rights="none" pattern="PICT" />.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade imagemagick

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109964