CVE-2026-105398

ImageMagick: ImageMagick: Denial of Service via heap buffer overflow in GetVirtualPixels

Published Oct 8, 2026 CVSS 3.1 · 5.1 Medium EPSS n/a KEV · Not listed

Description

This CVE ID has been rejected as a duplicate.

No data.

No data available yet.

No solution or workaround provided in the CVE record

No advisories available

No CVSS v4.0

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jvjm-9f73-fhpq
https://nvd.nist.gov/vuln/detail/CVE-2026-105398
https://www.cve.org/CVERecord?id=CVE-2026-105398
https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-heap-buffer-overflow-via-getvirtualpixels-api

History

Type	Values Removed	Values Added
Title	ImageMagick before 7.1.2-31 Heap Buffer Overflow via GetVirtualPixels API	ImageMagick: ImageMagick: Denial of Service via heap buffer overflow in GetVirtualPixels
Weaknesses	CWE-190
Metrics	cvssV4_0 `{'score': 5.9, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description	ImageMagick before 7.1.2-31 contains a heap buffer overflow vulnerability that allows attackers to overwrite heap memory by making a crafted call to the GetVirtualPixels API. Attackers can trigger the out-of-bounds heap write through crafted input to crash the server, causing a denial of service.	This CVE ID has been rejected as a duplicate.
CPEs	cpe:2.3:a:imagemagick:imagemagick::::::::
Metrics	cvssV4_0 `{'score': 5.9, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`	cvssV4_0 `{'score': 5.9, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}`

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2026-105398 https://www.cve.org/CVERecord?id=CVE-2026-105398
Metrics	threat_severity `None`	threat_severity `Moderate`

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		ImageMagick before 7.1.2-31 contains a heap buffer overflow vulnerability that allows attackers to overwrite heap memory by making a crafted call to the GetVirtualPixels API. Attackers can trigger the out-of-bounds heap write through crafted input to crash the server, causing a denial of service.
Title		ImageMagick before 7.1.2-31 Heap Buffer Overflow via GetVirtualPixels API
First Time appeared		Imagemagick Imagemagick imagemagick
Weaknesses		CWE-190
CPEs		cpe:2.3:a:imagemagick:imagemagick::::::::
Vendors & Products		Imagemagick Imagemagick imagemagick
References		https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jvjm-9f73-fhpq https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-heap-buffer-overflow-via-getvirtualpixels-api
Metrics		cvssV3_1 `{'score': 5.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 5.9, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`