CVE-2026-109964 ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder
Attackers can achieve code execution or cause denial of service by supplying a crafted PICT file to vulnerable ImageMagick versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-109964?
CVE-2026-109964 is a medium-severity memory corruption vulnerability in ImageMagick, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution.
Weakness: CWE-124
Which versions are affected by CVE-2026-109964?
How do I fix CVE-2026-109964?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-109964 being exploited?
There is no known exploitation of CVE-2026-109964 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-109964, ECHO-88a2-2fcc-be2a, GHSA-279f-3w5r-54f5, GHSA-mqmp-r5jh-jx7w, UBUNTU-CVE-2026-109964.