CVE-2026-109964: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-109964 is a heap buffer underwrite (buffer underflow) vulnerability in ImageMagick's PICT image decoder, specifically in the DecodeImage() function within coders/pict.c, affecting only 32-bit builds. The flaw exists in ImageMagick versions before 7.1.2-33 (for the 7.x branch) and before 6.9.13-58 (for the 6.x branch). It was disclosed on October 13, 2026, with patches released simultaneously. The vulnerability carries a CVSS v3.1 base score of 5.6 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, VulnCheck).

The root cause is a pointer arithmetic integer overflow (CWE-124: Buffer Underwrite / CWE-190: Integer Overflow or Wraparound) in the DecodeImage() function in coders/pict.c. On 32-bit systems, the expression q = pixels + y * (ssize_t) width * (ssize_t) GetPixelChannels(image) can overflow when an attacker supplies a crafted PICT file with maximized row, column, and bytes-per-line values, causing the computed pointer q to wrap around and point to memory below the allocated heap buffer. This bypasses existing bounds checks and allows writing up to 128 controlled bytes below the heap buffer. The fix adds an explicit underflow check (if (q < pixels)) in both the uncompressed and RLE pixel decoding paths (ImageMagick Advisory, Patch Commit 7.x, Patch Commit 6.x).

A successful exploit allows an unauthenticated attacker to write up to 128 controlled bytes below a heap buffer, which can result in arbitrary code execution or a service crash (denial of service) depending on the memory layout and exploitation technique employed. The vulnerability is limited to 32-bit builds of ImageMagick, reducing the scope of affected deployments. Confidentiality, integrity, and availability are all assessed as low impact under CVSS v3.1, reflecting the constrained write primitive and the high attack complexity required (GitHub Advisory, VulnCheck).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, indicating very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity — specifically, the target must be running a 32-bit build of ImageMagick and must process a crafted PICT file supplied by the attacker, which limits the practical attack surface (VulnCheck).

1. Identify target: Locate a service or application running a 32-bit build of ImageMagick (versions < 7.1.2-33 or < 6.9.13-58) that accepts and processes user-supplied image files, such as a web application with image upload functionality.
2. Craft malicious PICT file: Create a PICT image file with maximized row, column, and bytes-per-line header values designed to trigger a 32-bit pointer arithmetic integer overflow in DecodeImage() within coders/pict.c.
3. Trigger overflow: Submit the crafted PICT file to the target application. When ImageMagick processes the file, the expression q = pixels + y * width * GetPixelChannels(image) overflows on 32-bit systems, causing q to point below the allocated heap buffer.
4. Achieve write primitive: The overflowed pointer allows writing up to 128 controlled bytes below the heap buffer, potentially corrupting adjacent heap metadata or function pointers.
5. Achieve code execution or crash: Depending on the heap layout and memory allocator behavior, the controlled write may enable arbitrary code execution under the ImageMagick process's privileges, or cause a crash resulting in denial of service (ImageMagick Advisory, VulnCheck).

• File System: Unexpected PICT (.pict, .pic) files in upload directories or temporary image processing folders, particularly with anomalously large or maximized header field values.
• Process: Unexpected child processes spawned by the ImageMagick process (e.g., convert, magick) such as shells (/bin/sh, /bin/bash) or network utilities (curl, wget, nc).
• Logs: Application or web server logs showing repeated submission of PICT-format files from a single source IP; ImageMagick error logs referencing coders/pict.c or DecodeImage with corruption or abort signals.
• Network: Unusual outbound connections from the image processing server to unknown external IPs, potentially indicating a reverse shell or data exfiltration following successful exploitation.

Upgrade ImageMagick to version 7.1.2-33 or later (for 7.x users) or 6.9.13-58 or later (for 6.x users), as patches are available for both branches (GitHub Advisory, Red Hat Bugzilla). If immediate patching is not feasible, restrict or disable processing of PICT image files from untrusted sources — this can be enforced via ImageMagick's security policy (policy.xml) by denying the PICT coder. Additionally, where possible, deploy 64-bit builds of ImageMagick, as the vulnerability is specific to 32-bit builds and the pointer arithmetic overflow does not occur on 64-bit architectures.

The vulnerability was reported by researcher idoprog and acknowledged by the ImageMagick maintainer dlemstra via a GitHub Security Advisory (ImageMagick Advisory). Early social media activity was observed on Mastodon (infosec.exchange) shortly after disclosure, and the vulnerability was indexed by multiple security tracking platforms including VulnDB, Vulners, and VulnCheck within hours of publication. No major media coverage or significant community controversy has been noted, consistent with the moderate severity and limited scope of the issue.