4.8 Medium

CVE-2026-116160 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 Animate

Description

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation when processing crafted images. Attackers can supply a malicious image that, when a user runs an X11 animate operation on it, overwrites heap memory and can crash the application.

CVSS 4.0 detail

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Exploitable with local access to the machine, without an account and if a user takes an action; the impact on data or service is limited.

Attack vector: Local
Attack complexity: Low
Attack requirements: None
Privileges required: None
Interaction: Passive
Confidentiality: None
Integrity: None
Availability: Low
Confidentiality of other systems: None
Integrity of other systems: None
Availability of other systems: None

Affected products and versions

Product	Affected versions	Fixed in
ImageMagick 6.9	earliest → < 6.9.13-58	6.9.13-58

References

GitHub Security Advisory (GHSA-6p6q-wfrv-ffhh) github.com
VulnCheck Advisory: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 Animate www.vulncheck.com

Timeline

Published October 25, 2026
Last modified November 5, 2026

The 276 CVEs of ImageMagick →

CVE-2026-123273 ImageMagick before 7.1.2-35 and 6.9.13-60 Infinite Loop via SVG Decoder 7.1 High CVE-2026-119124 ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause… 4.8 Medium CVE-2026-119123 ImageMagick before 7.1.2-34 Stack Overflow in TIFF Decoder 6.3 Medium CVE-2026-116158 ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup… 2.0 Low

Track this CVE