Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2026-23876

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the XBM image decoder (ReadXBMImage) allows an attacker to write controlled data past the allocated heap buffer when processing a maliciously crafted image file. Any operation that reads or identifies an image can trigger the overflow, making it exploitable via common image upload and processing pipelines. Versions 7.1.2-13 and 6.9.13-38 fix the issue.

Published

2026-01-20T01:15:57.440

Last Modified

2026-01-29T13:54:14.303

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 8.1 (HIGH)

Weaknesses
  • Type: Primary
    CWE-122
    CWE-190
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application imagemagick imagemagick < 6.9.13-38 Yes
Application imagemagick imagemagick < 7.1.2-13 Yes
References