CVE-2026-33900: ImageMagick Buffer Overflow Vulnerability

CVE-2026-33900 Overview

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the VIFF encoder contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out-of-bounds heap write, potentially causing a crash. This vulnerability stems from improper handling of size calculations in the coders/viff.c file, which can lead to memory allocation failures and subsequent heap corruption.

Critical Impact

Exploitation of this integer overflow vulnerability on 32-bit systems can result in denial of service through application crashes due to out-of-bounds heap writes during VIFF image encoding operations.

Affected Products

• ImageMagick versions below 7.1.2-19
• ImageMagick versions below 6.9.13-44
• Magick.NET versions below 14.12.0

Discovery Timeline

• 2026-04-13 - CVE-2026-33900 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2026-33900

Vulnerability Analysis

This vulnerability is classified as CWE-190 (Integer Overflow or Wraparound). The flaw exists in the VIFF encoder component of ImageMagick, specifically within coders/viff.c. On 32-bit builds, when converting images to the VIFF raster format, the code performs size calculations that can experience integer truncation. When the calculated packets value exceeds the maximum value representable by size_t on 32-bit systems, the truncation causes the memory allocation to be smaller than expected, leading to an out-of-bounds heap write when pixel data is subsequently written.

The vulnerability requires network-based delivery of a malicious image but has high attack complexity due to the specific conditions required (32-bit build, specific image dimensions causing overflow). While there is no impact on confidentiality or integrity, successful exploitation results in high availability impact through application crashes.

Root Cause

The root cause is the absence of validation to ensure that the calculated packets value fits within the bounds of size_t before passing it to the memory allocation function AcquireVirtualMemory(). On 32-bit systems, when this value exceeds 4GB, it wraps around, resulting in a significantly smaller memory allocation than required for the actual pixel data.

Attack Vector

An attacker could exploit this vulnerability by crafting a malicious VIFF image file with dimensions calculated to trigger the integer overflow condition. When a vulnerable 32-bit ImageMagick installation processes this image, the truncated memory allocation followed by the full data write would cause heap corruption, resulting in a denial of service. The attack vector is network-based, as the malicious image could be delivered through web applications, email attachments, or other network-accessible image processing workflows.

     /*
       Convert MIFF to VIFF raster pixels.
     */
+    if (packets != (MagickSizeType) ((size_t) packets)
+      ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
     pixel_info=AcquireVirtualMemory((size_t) packets,sizeof(*pixels));
     if (pixel_info == (MemoryInfo *) NULL)
       ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");

Source: GitHub Commit Reference

Detection Methods for CVE-2026-33900

Indicators of Compromise

• Unexpected ImageMagick process crashes during VIFF encoding operations
• Segmentation fault errors in application logs related to ImageMagick processing
• Memory allocation failure messages followed by unexpected behavior in image processing workflows

Detection Strategies

• Monitor for ImageMagick process crashes with heap corruption signatures, particularly on 32-bit systems
• Implement file inspection for incoming VIFF images with unusually large dimension metadata
• Deploy application-level logging to capture memory allocation failures in image processing pipelines

Monitoring Recommendations

• Enable verbose logging for ImageMagick operations to capture early warning signs of exploitation attempts
• Set up alerts for repeated crashes of services that utilize ImageMagick for image processing
• Monitor system memory usage patterns for anomalies during image encoding operations

How to Mitigate CVE-2026-33900

Immediate Actions Required

• Upgrade ImageMagick to version 7.1.2-19 or later for the 7.x branch
• Upgrade ImageMagick to version 6.9.13-44 or later for the 6.x branch
• Upgrade Magick.NET to version 14.12.0 or later if using the .NET wrapper
• Consider migrating 32-bit deployments to 64-bit where possible to eliminate this class of vulnerability

Patch Information

The vulnerability has been fixed in ImageMagick versions 6.9.13-44 and 7.1.2-19. The patch adds an explicit check to verify that the packets value can be safely cast to size_t without truncation before proceeding with memory allocation. For detailed patch information, refer to the GitHub Commit Reference and the GitHub Security Advisory GHSA-v67w-737x-v2c9.

Workarounds

• If immediate patching is not possible, consider disabling VIFF format support in ImageMagick's policy.xml configuration
• Implement input validation to reject VIFF images before they reach ImageMagick processing
• Use 64-bit builds of ImageMagick where the integer truncation issue does not manifest

# Disable VIFF coder in ImageMagick policy.xml
# Add the following line to /etc/ImageMagick-7/policy.xml or equivalent
<policy domain="coder" rights="none" pattern="VIFF" />