Stack Overflow Vulnerability in ImageMagick TIFF Decoder
CVE-2026-119123

6.3MEDIUM

Key Information:

Vendor

Imagemagick
Status
Imagemagick
Vendor
CVE Published:
29 October 2026

What is CVE-2026-119123?

ImageMagick versions prior to 7.1.2-34 exhibit a stack overflow vulnerability within the TIFF decoder that can be exploited when the DNG decoder is disabled. This flaw allows attackers to inject malformed image files during processing, potentially leading to application crashes and resulting in denial of service. It is crucial for users of ImageMagick to update to the latest version to mitigate this risk.

Affected Version(s)

ImageMagick 0 < 7.1.2-34

ImageMagick 7.1.2-34

References

https://github.com/ImageMagick/ImageMagick/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/imagemagick-before-7...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mik4jenk-cmyk
.