6.3 Medium

CVE-2026-119123 ImageMagick before 7.1.2-34 Stack Overflow in TIFF Decoder

Description

ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image file for processing to trigger the stack overflow and crash the application, causing denial of service.

CVSS 4.0 detail

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Exploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.

Attack vector: Network
Attack complexity: High
Attack requirements: Present
Privileges required: None
Interaction: None
Confidentiality: None
Integrity: None
Availability: Low
Confidentiality of other systems: None
Integrity of other systems: None
Availability of other systems: None

Affected products and versions

Product	Affected versions	Fixed in
ImageMagick 7.1	earliest → < 7.1.2-34	7.1.2-34

References

GitHub Security Advisory (GHSA-g5j8-ff59-wp88) github.com
VulnCheck Advisory: ImageMagick before 7.1.2-34 Stack Overflow in TIFF Decoder www.vulncheck.com

Timeline

Published October 29, 2026
Last modified November 4, 2026

The 276 CVEs of ImageMagick →

CVE-2026-123273 ImageMagick before 7.1.2-35 and 6.9.13-60 Infinite Loop via SVG Decoder 7.1 High CVE-2026-119124 ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause… 4.8 Medium CVE-2026-116160 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 Animate 4.8 Medium CVE-2026-116159 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color… 4.8 Medium

Track this CVE