CVE-2026-105401

ImageMagick: ImageMagick: Denial of Service via heap buffer overflow in distributed pixel cache server

Published Oct 8, 2026 CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed

Description

This CVE ID has been rejected as a duplicate.

No data.

No data available yet.

No solution or workaround provided in the CVE record

No advisories available

No CVSS v4.0

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4fq9-vrx7-gv92
https://nvd.nist.gov/vuln/detail/CVE-2026-105401
https://www.cve.org/CVERecord?id=CVE-2026-105401
https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-heap-buffer-overflow-in-distributed-pixel-cache-server

History

Type	Values Removed	Values Added
Weaknesses	CWE-122
Metrics	cvssV4_0 `{'score': 6.0, 'vector': 'CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}`

Type	Values Removed	Values Added
Description	ImageMagick before 7.1.2-31 contains a heap buffer overflow vulnerability in the distributed pixel cache server that allows connecting clients to overwrite heap memory by sending crafted data. Attackers can connect to the distributed pixel cache server and transmit malicious data to trigger a heap buffer over-write that crashes the server, causing denial of service.	This CVE ID has been rejected as a duplicate.
Title	ImageMagick before 7.1.2-31 Heap Buffer Overflow in Distributed Pixel Cache Server	ImageMagick: ImageMagick: Denial of Service via heap buffer overflow in distributed pixel cache server
CPEs	cpe:2.3:a:imagemagick:imagemagick::::::::
Metrics	cvssV4_0 `{'score': 6, 'vector': 'CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`	cvssV4_0 `{'score': 6.0, 'vector': 'CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}`

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2026-105401 https://www.cve.org/CVERecord?id=CVE-2026-105401
Metrics	threat_severity `None`	threat_severity `Moderate`

Type	Values Removed	Values Added
Description		ImageMagick before 7.1.2-31 contains a heap buffer overflow vulnerability in the distributed pixel cache server that allows connecting clients to overwrite heap memory by sending crafted data. Attackers can connect to the distributed pixel cache server and transmit malicious data to trigger a heap buffer over-write that crashes the server, causing denial of service.
Title		ImageMagick before 7.1.2-31 Heap Buffer Overflow in Distributed Pixel Cache Server
First Time appeared		Imagemagick Imagemagick imagemagick
Weaknesses		CWE-122
CPEs		cpe:2.3:a:imagemagick:imagemagick::::::::
Vendors & Products		Imagemagick Imagemagick imagemagick
References		https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4fq9-vrx7-gv92 https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-heap-buffer-overflow-in-distributed-pixel-cache-server
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 6, 'vector': 'CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`