CVE-2026-33536 — Vulnerability in Magick.NET-Q8-x86 — CVE Details
MEDIUM
ImageMagick has an Out-of-bounds Write via InterpretImageFilename
Published March 26, 2026Updated September 10, 2026Source: osv
Summary
Due to an incorrect return value on certain platforms a pointer is incremented past the end of a buffer that is on the stack and that could result in an out of bounds write.
```
=================================================================
==48558==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x00016b9b7490 at pc 0x0001046d48ac bp 0x00016b9b31d0 sp 0x00016b9b31c8
WRITE of size 1 at 0x00016b9b7490 thread T0
```
Advisory Timeline
- First published March 26, 2026 (200 days ago).
- Last revised September 10, 2026 — 167 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
NuGet
Update Magick.NET-Q8-x86 to 14.11.1 or laterdotnet add package Magick.NET-Q8-x86 --version 14.11.1
NuGet
Update Magick.NET-Q16-HDRI-AnyCPU to 14.11.1 or laterdotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.11.1
NuGet
Update Magick.NET-Q8-arm64 to 14.11.1 or laterdotnet add package Magick.NET-Q8-arm64 --version 14.11.1
NuGet
Update Magick.NET-Q8-x64 to 14.11.1 or laterdotnet add package Magick.NET-Q8-x64 --version 14.11.1
NuGet
Update Magick.NET-Q16-x86 to 14.11.1 or laterdotnet add package Magick.NET-Q16-x86 --version 14.11.1
NuGet
Update Magick.NET-Q16-HDRI-OpenMP-arm64 to 14.11.1 or laterdotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.11.1
NuGet
Update Magick.NET-Q16-OpenMP-x64 to 14.11.1 or laterdotnet add package Magick.NET-Q16-OpenMP-x64 --version 14.11.1
NuGet
Update Magick.NET-Q16-OpenMP-arm64 to 14.11.1 or laterdotnet add package Magick.NET-Q16-OpenMP-arm64 --version 14.11.1
NuGet
Update Magick.NET-Q16-AnyCPU to 14.11.1 or laterdotnet add package Magick.NET-Q16-AnyCPU --version 14.11.1
NuGet
Update Magick.NET-Q16-HDRI-x64 to 14.11.1 or laterdotnet add package Magick.NET-Q16-HDRI-x64 --version 14.11.1
NuGet
Update Magick.NET-Q16-x64 to 14.11.1 or laterdotnet add package Magick.NET-Q16-x64 --version 14.11.1
NuGet
Update Magick.NET-Q16-HDRI-arm64 to 14.11.1 or laterdotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.11.1
NuGet
Update Magick.NET-Q16-HDRI-x86 to 14.11.1 or laterdotnet add package Magick.NET-Q16-HDRI-x86 --version 14.11.1
NuGet
Update Magick.NET-Q16-arm64 to 14.11.1 or laterdotnet add package Magick.NET-Q16-arm64 --version 14.11.1
NuGet
Update Magick.NET-Q16-OpenMP-x86 to 14.11.1 or laterdotnet add package Magick.NET-Q16-OpenMP-x86 --version 14.11.1
NuGet
Update Magick.NET-Q8-OpenMP-x64 to 14.11.1 or laterdotnet add package Magick.NET-Q8-OpenMP-x64 --version 14.11.1
NuGet
Update Magick.NET-Q8-AnyCPU to 14.11.1 or laterdotnet add package Magick.NET-Q8-AnyCPU --version 14.11.1
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (17)
Affects 1 ecosystem: nuget (17).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| Magick.NET-Q8-x86 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+224 more) | 14.11.1 |
| Magick.NET-Q16-HDRI-AnyCPU | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+205 more) | 14.11.1 |
| Magick.NET-Q8-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+53 more) | 14.11.1 |
| Magick.NET-Q8-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+224 more) | 14.11.1 |
| Magick.NET-Q16-x86 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+224 more) | 14.11.1 |
| Magick.NET-Q16-HDRI-OpenMP-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+53 more) | 14.11.1 |
| Magick.NET-Q16-OpenMP-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+105 more) | 14.11.1 |
| Magick.NET-Q16-OpenMP-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+53 more) | 14.11.1 |
| Magick.NET-Q16-AnyCPU | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+208 more) | 14.11.1 |
| Magick.NET-Q16-HDRI-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+205 more) | 14.11.1 |
| Magick.NET-Q16-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+224 more) | 14.11.1 |
| Magick.NET-Q16-HDRI-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+53 more) | 14.11.1 |
| Magick.NET-Q16-HDRI-x86 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+205 more) | 14.11.1 |
| Magick.NET-Q16-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+53 more) | 14.11.1 |
| Magick.NET-Q16-OpenMP-x86 | nuget | All versions | 14.11.1 |
| Magick.NET-Q8-OpenMP-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+105 more) | 14.11.1 |
| Magick.NET-Q8-AnyCPU | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+208 more) | 14.11.1 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-121
- CWE-787Out-of-bounds WriteMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 5.1 score means for each attack dimension.
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Frequently Asked Questions
- What is CVE-2026-33536?
- ImageMagick has an Out-of-bounds Write via InterpretImageFilename This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 5.1/10).
- How do I check if my project is affected by CVE-2026-33536?
- CVE-2026-33536 affects Magick.NET-Q8-x86, Magick.NET-Q16-HDRI-AnyCPU and Magick.NET-Q8-arm64 (and 14 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-33536 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
5.1
Exploitation requires specific conditions or has limited impact. Remediate within weeks.
Also Known As
GHSA-8793-7xv6-82cf
Related CVEs
- CVE-2026-46520HIGH
ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions
- CVE-2026-46522HIGH
ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion
- CVE-2026-33908HIGH
ImageMagick has a Stack Overflow in DestroyXMLTree()
- CVE-2026-53461HIGH
ImageMagick has out-of-bounds write in ICON decoder due to incorrect loop
- CVE-2026-30929HIGH
ImageMagick has stack buffer overflow in MagnifyImage
- CVE-2026-47165MEDIUM
ImageMagick: Information Disclosure in distributed pixel cache server because it is not using a challenge–response authentication model
- CVE-2026-55594MEDIUM
ImageMagick: Stack Overflow in MVG decoder due to missing depth check.
- CVE-2026-61465LOW
ImageMagick: Policy Bypass possible with matrix-backed operations
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies