CVE-2026-32636 | ImageMagick up to 6.9.13-41/7.1.2-16 Image Parser NewXMLTree out-of-bounds write (GHSA-gc62-2v5p-qpmp)

VDB-351628 · CVE-2026-32636 · GHSA-GC62-2V5P-QPMP IMAGEMAGICK UP TO 6.9.13-41/7.1.2-16 IMAGE PARSER NEWXMLTREE OUT-OF-BOUNDS WRITE HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 5.7 $0-$5k 1.38+ Summaryinfo A vulnerability was found in ImageMagick up to 6.9.13-41/7.1.2-16 and classified as critical. This affects the function NewXMLTree of the component Image Parser. Executing a manipulation can lead to out-of-bounds write. This vulnerability appears as CVE-2026-32636. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component. Detailsinfo A vulnerability was found in ImageMagick up to 6.9.13-41/7.1.2-16. It has been declared as critical. This vulnerability affects the function NewXMLTree of the component Image Parser. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue. The advisory is shared for download at github.com. This vulnerability was named CVE-2026-32636 since 03/12/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. Upgrading to version 6.9.13-42 or 7.1.2-17 eliminates this vulnerability. The upgrade is hosted for download at github.com. Productinfo Type Image Processing Software Name ImageMagick Version 6.9.13-41 7.1.2-16 License open-source Website Product: https://www.imagemagick.org/ CPE 2.3info 🔒 🔒 CPE 2.2info 🔒 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv3info VulDB Meta Base Score: 5.8 VulDB Meta Temp Score: 5.7 VulDB Base Score: 6.3 VulDB Temp Score: 6.0 VulDB Vector: 🔒 VulDB Reliability: 🔍 CNA Base Score: 5.3 CNA Vector (GitHub_M): 🔒 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Out-of-bounds write CWE: CWE-787 / CWE-119 CAPEC: 🔒 ATT&CK: 🔒 Physical: No Local: No Remote: Yes Availability: 🔒 Status: Not defined Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: ImageMagick 6.9.13-42/7.1.2-17 Timelineinfo 03/12/2026 CVE reserved 03/18/2026 +6 days Advisory disclosed 03/18/2026 +0 days VulDB entry created 03/19/2026 +0 days VulDB entry last update Sourcesinfo Product: imagemagick.org Advisory: GHSA-gc62-2v5p-qpmp Status: Confirmed CVE: CVE-2026-32636 (🔒) GCVE (CVE): GCVE-0-2026-32636 GCVE (VulDB): GCVE-100-351628 Entryinfo Created: 03/19/2026 00:02 Changes: 03/19/2026 00:02 (67) Complete: 🔍 Cache ID: 99:1B0:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸