CVE-2026-119124

MediumCVSS 5.5/10Last modified Nov 3, 2026

Description

ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the application.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-122

Affected software

Vendor	Product	Versions
ImageMagick	ImageMagick	< 7.1.2-34

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x48p-6655-8qgvVendor Advisory
https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-34-heap-buffer-overflow-via-morph-optionThird Party Advisory

Timeline

Published: Oct 29, 2026
Last modified: Nov 3, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1191253.1Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 returns the stored value of a field reverted by a beforeSave trigger in object u CVE-2026-1191263.1Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the sav CVE-2026-1191278.1ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poiso CVE-2026-1191287.4ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set CVE-2026-1191298.1ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to app CVE-2026-119139.8vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.CVE-2026-1191302.6Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-htt CVE-2026-1191315.3Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http that lets guests cra CVE-2026-1191324.8Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by tra CVE-2026-1191332.6Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavio CVE-2026-1191346.2Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component insta CVE-2026-1191354.8Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type tha