CVE-2026-33536: 
C# vulnerability analysis and mitigation

CVE-2026-33536 is a stack-based buffer overflow vulnerability in ImageMagick's InterpretImageFilename function that can result in an out-of-bounds write to stack memory. It was disclosed on March 24, 2026 by researcher "fumfel" via the ImageMagick GitHub security advisory (GHSA-8793-7xv6-82cf) and published to the NVD on March 26, 2026. Affected versions include ImageMagick before 7.1.2-18 and before 6.9.13-43, as well as Magick.NET NuGet packages before 14.11.1. The vulnerability carries a CVSS v3.1 base score of 5.1 (Moderate) (GitHub Advisory, Github Advisory DB).

The root cause is an incorrect return value handling on certain platforms within the InterpretImageFilename function, causing a pointer to be incremented past the end of a stack-allocated buffer (CWE-121: Stack-based Buffer Overflow; CWE-787: Out-of-bounds Write). The flaw results in a single-byte write beyond the buffer boundary, as confirmed by AddressSanitizer output showing a WRITE of size 1 at an address beyond the stack buffer. The attack vector is local, requires no privileges, but has high attack complexity, limiting practical exploitability. No public proof-of-concept exploit code has been identified (GitHub Advisory, Github Advisory DB).

Successful exploitation of this vulnerability can cause a denial of service (application crash) due to memory corruption on the stack. The impact is limited to availability — there is no confidentiality or integrity impact identified. Because the attack vector is local and attack complexity is high, the practical risk of widespread exploitation is low, and there is no evidence of lateral movement potential or sensitive data exposure associated with this vulnerability (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-33536. The EPSS score is approximately 0.007% (1st percentile), indicating a very low probability of exploitation within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Github Advisory DB).

Users should upgrade ImageMagick to version 7.1.2-18 or later (for the 7.x branch) or 6.9.13-43 or later (for the 6.x branch). Magick.NET NuGet package users should upgrade to version 14.11.1 or later. No configuration-based workarounds have been published; upgrading to a patched release is the recommended remediation. Linux distribution users (SUSE, Debian, Amazon Linux) should apply vendor-provided security updates as they become available (GitHub Advisory, Github Advisory DB).

The vulnerability was reported by researcher "fumfel" and patched by ImageMagick maintainer "dlemstra." Multiple Linux distributions including SUSE, Debian, and Amazon Linux have issued security advisories and package updates addressing this CVE. No significant social media discussion or notable researcher commentary beyond the standard advisory process has been identified (GitHub Advisory).