Loading story…
A high-severity heap buffer overflow in ImageMagick’s XBM image decoder (coders/xbm.c, ReadXBMImage) can be triggered by processing a specially crafted XBM file, including through common image upload/processing workflows. The flaw stems from integer truncation where image->rows (a 64-bit size_t) is cast to a 32-bit unsigned int for allocation, but subsequent write operations iterate using the original (non-truncated) image->rows value, creating a mismatch that can lead to memory corruption or crashes when attacker-supplied dimensions are large.
Reporting indicates the overflow is particularly dangerous because attackers can influence both the overflow size (via image dimensions such as rows/columns) and the data written (via hex values embedded in the XBM content), enabling attacker-controlled bytes to be written past the heap buffer. The issue affects ImageMagick versions prior to 7.1.2-13 and 6.9.13-38 and is fixed in 7.1.2-13 and 6.9.13-38; the CVE record lists a high-impact CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H and maps the weakness to CWE-190 and CWE-122, with upstream references including the vendor advisory and patch commit.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
GitHub Security Advisories received CVE-2026-23876 on January 20, 2026, documenting a high-severity heap buffer overflow in ImageMagick's XBM parser affecting versions prior to 7.1.2-13 and 6.9.13-38. The advisory noted the issue could be triggered through image read or identify operations, making it relevant to image upload and processing pipelines.
ImageMagick addressed a heap buffer overflow in its XBM image decoder (ReadXBMImage / coders/xbm.c) by releasing fixes in versions 7.1.2-13 and 6.9.13-38. The flaw stemmed from integer truncation that could cause undersized allocation followed by attacker-controlled out-of-bounds heap writes when processing crafted XBM images.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple **ImageMagick** vulnerabilities were disclosed affecting common image-processing deployments (web apps, CMS integrations, and automated pipelines). **CVE-2026-25794** is a heap-based buffer overflow triggered when writing UHDR images: `WriteUHDRImage` (`coders/uhdr.c`) uses 32-bit `int` arithmetic to compute pixel buffer size, allowing a signed integer overflow on large dimensions that leads to an undersized heap allocation and out-of-bounds write; ImageMagick **7.1.2-15** includes a patch. Separately, Belgium’s CCB warned that **CVE-2026-23876** is a high-severity heap buffer overflow in the XBM decoder (`ReadXBMImage`) that can be triggered by a crafted image and may enable memory corruption and potential code execution; the advisory notes a **public PoC** and urges immediate patching. A second ImageMagick issue, **CVE-2026-25965**, allows a **policy bypass via path traversal** because the path security policy is applied to the raw filename string before filesystem normalization; attackers can use traversal to read sensitive files (local file disclosure) even when `policy-secure.xml` is in place. Fixes were reported in **ImageMagick 7.1.2-15** and **6.9.13-40**, and guidance indicates policy hardening may be required to ensure write operations are also blocked. A separate disclosure for **Traccar** stored XSS via malicious SVG upload is unrelated to the ImageMagick issues and should be tracked independently.
Jun 29, 2026
Two high-severity vulnerabilities were disclosed in **MolotovCherry Android-ImageMagick7**, affecting releases prior to `7.1.2-10` and `7.1.2-11`. **CVE-2026-33854** is an out-of-bounds write flaw classified as `CWE-787`, which can lead to memory corruption and carries a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`. **CVE-2026-4755** is an improper input validation issue classified as `CWE-20`, affecting versions before `7.1.2-11` with a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. The disclosures indicate both flaws could have severe impact on confidentiality, integrity, and availability, with the input validation bug standing out because it is network-exploitable and requires no privileges or user interaction. References added to the CVE records point to GitHub pull requests, including **PR #193**, suggesting fixes or remediation work is available upstream. Organizations using Android-ImageMagick7 should identify exposed deployments and prioritize upgrades to patched versions.
Jun 29, 2026
OpenEXR patched two high-severity memory corruption vulnerabilities that can be triggered by decoding crafted `.exr` image files. **CVE-2026-34545** affects OpenEXR `3.4.0` through before `3.4.7` and stems from an integer overflow in the HTJ2K decoder when processing an image with a channel width of `32768`, leading to a heap-based buffer overflow with controlled out-of-bounds writes. The flaw could enable remote code execution in applications that open malicious EXR images, particularly where untrusted files are automatically parsed. A second flaw, **CVE-2026-34544**, affects OpenEXR `3.4.0` through before `3.4.8` and allows an out-of-bounds write in `uncompress_b44_impl()` during `exr_decoding_run()` when handling crafted B44 or B44A-compressed EXR files. Depending on heap layout, the issue can cause immediate crashes or corrupt adjacent allocations, with the CVE classified under `CWE-787` and `CWE-190`. Organizations using OpenEXR in media pipelines, rendering tools, or image-processing applications should upgrade to **OpenEXR 3.4.8** to address both issues.
Jun 29, 2026