CVE-2026-33899

NameCVE-2026-33899
DescriptionImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-189 and 6.9.13-44, when `Magick` parses an XML file it is possible that a single zero byte is written out of the bounds. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
imagemagick (PTS)bullseye8:6.9.11.60+dfsg-1.3+deb11u4vulnerable
bullseye (security)8:6.9.11.60+dfsg-1.3+deb11u10vulnerable
bookworm8:6.9.11.60+dfsg-1.6+deb12u5vulnerable
bookworm (security)8:6.9.11.60+dfsg-1.6+deb12u8vulnerable
trixie8:7.1.1.43+dfsg1-1+deb13u5vulnerable
trixie (security)8:7.1.1.43+dfsg1-1+deb13u7vulnerable
forky, sid8:7.1.2.18+dfsg1-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
imagemagicksource(unstable)(unfixed)

Notes

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr67-pvmx-2pp2
https://github.com/ImageMagick/ImageMagick/commit/ae679e2fd19ec656bfab9f822ae4cf06bf91604d (7.1.2-19)
https://github.com/ImageMagick/ImageMagick6/commit/d398a4b5290a9729e2e5bf36b4d2b2fb71c9d8bb (6.9.13-44)
https://github.com/ImageMagick/ImageMagick6/commit/149326dd993e8833e42e35d21bacaa0c98e11c34 (6.9.13-44)

Search for package or bug name: Reporting problems