github.com
https://github.com/ImageMagick/ImageMagick CVE-2026-32636
MEDIUM
ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash
Record summary
CVE-2026-32636 has a selected CVSS score of 5.3 (medium).
Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 19, 2026 · Source: CVE List
Affected products and versions
Showing 12 of 20| Product | Source | Version range | Status |
|---|---|---|---|
ImageMagickBrowse ImageMagick / ImageMagick | CVE List | < 6.9.13-42 | affected |
| < 7.1.2-17 | affected | ||
Magick.NET-Q16-AnyCPUBrowse NuGet / Magick.NET-Q16-AnyCPU | GitHub Advisory | Before 14.11.0 · Fixed in 14.11.0 | affected |
Magick.NET-Q16-HDRI-AnyCPUBrowse NuGet / Magick.NET-Q16-HDRI-AnyCPU | GitHub Advisory | Before 14.11.0 · Fixed in 14.11.0 | affected |
Magick.NET-Q16-HDRI-OpenMP-arm64Browse NuGet / Magick.NET-Q16-HDRI-OpenMP-arm64 | GitHub Advisory | Before 14.11.0 · Fixed in 14.11.0 | affected |
Magick.NET-Q16-HDRI-OpenMP-x64Browse NuGet / Magick.NET-Q16-HDRI-OpenMP-x64 | GitHub Advisory | Before 14.11.0 · Fixed in 14.11.0 | affected |
Magick.NET-Q16-HDRI-arm64Browse NuGet / Magick.NET-Q16-HDRI-arm64 | GitHub Advisory | Before 14.11.0 · Fixed in 14.11.0 | affected |
Magick.NET-Q16-HDRI-x64Browse NuGet / Magick.NET-Q16-HDRI-x64 | GitHub Advisory | Before 14.11.0 · Fixed in 14.11.0 | affected |
Magick.NET-Q16-HDRI-x86Browse NuGet / Magick.NET-Q16-HDRI-x86 | GitHub Advisory | Before 14.11.0 · Fixed in 14.11.0 | affected |
Magick.NET-Q16-OpenMP-arm64Browse NuGet / Magick.NET-Q16-OpenMP-arm64 | GitHub Advisory | Before 14.11.0 · Fixed in 14.11.0 | affected |
Magick.NET-Q16-OpenMP-x64Browse NuGet / Magick.NET-Q16-OpenMP-x64 | GitHub Advisory | Before 14.11.0 · Fixed in 14.11.0 | affected |
Magick.NET-Q16-OpenMP-x86Browse NuGet / Magick.NET-Q16-OpenMP-x86 | GitHub Advisory | Before 14.11.0 · Fixed in 14.11.0 | affected |
Magick.NET-Q16-arm64Browse NuGet / Magick.NET-Q16-arm64 | GitHub Advisory | Before 14.11.0 · Fixed in 14.11.0 | affected |
References
5github.com
https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-17 github.comConfirmation
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gc62-2v5p-qpmp github.com
https://github.com/dlemstra/Magick.NET/releases/tag/14.11.0 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-32636