CVE-2026-33535: 
C# vulnerability analysis and mitigation

CVE-2026-33535 is an out-of-bounds write vulnerability in ImageMagick's X11 display interaction path that can lead to an application crash. It affects ImageMagick versions prior to 6.9.13-43 and versions 7.0.0-0 through 7.1.2-18, as well as Magick.NET NuGet packages prior to 14.11.1. The vulnerability was published on March 24, 2026, by maintainer dlemstra and reported by researcher unbengable12. The CVSS v3.1 base score is 4.0 (Moderate) per the GitHub Advisory, though NVD assigns 5.5 (Medium) (GitHub Advisory, ImageMagick Advisory).

The vulnerability is classified as CWE-787 (Out-of-bounds Write), specifically involving a write of a single zero byte beyond the intended buffer boundary within the X11 display interaction code path. The attack vector is local with low attack complexity, requiring no user interaction; the GitHub Advisory notes no privileges are required, while NVD's scoring reflects low privileges required. Exploitation occurs when ImageMagick processes X11 display operations, triggering the erroneous zero-byte write that corrupts adjacent memory and causes a crash (ImageMagick Advisory, GitHub Advisory).

Successful exploitation results in a denial of service through an application crash, with no impact on confidentiality or data integrity. The vulnerability is limited in scope — it affects only the availability of the ImageMagick process or any application embedding it (e.g., via Magick.NET) when X11 display functionality is invoked. There is no evidence of potential for lateral movement or sensitive data exposure (GitHub Advisory, ImageMagick Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.013% (0.007% per GitHub Advisory), placing it in the 0th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory).

ImageMagick has released patched versions 7.1.2-18 and 6.9.13-43 that address this vulnerability. For .NET users, Magick.NET packages should be updated to version 14.11.1 or later across all variants (Q8, Q16, HDRI, platform-specific). As a workaround where patching is not immediately possible, restricting local user access to systems running ImageMagick and disabling X11 display functionality can reduce exposure. Multiple Linux distributions including SUSE, Debian, and Amazon Linux 2023 have issued updated packages (ImageMagick Advisory, GitHub Advisory).

The vulnerability received routine coverage from Linux distribution security channels, with SUSE, Debian, and Amazon Linux issuing security advisories and updated packages. Tenable published multiple Nessus detection plugins (e.g., 303990, 305282, 307507, 309158, 311488) to identify affected systems. No notable researcher commentary or significant social media discussion has been observed beyond standard vulnerability tracking and distribution-level patching activity.