CVE-2026-33900: 
C# vulnerability analysis and mitigation

CVE-2026-33900 is a heap overflow vulnerability in ImageMagick caused by an integer overflow/wraparound in the VIFF (Visualization Image File Format) encoder, affecting only 32-bit builds. It was disclosed on April 13, 2026, and affects ImageMagick versions below 6.9.13-44 and 7.x versions below 7.1.2-19, as well as Magick.NET NuGet packages below version 14.12.0. The vulnerability was reported by researcher shitianyu-2004 and published under GHSA-v67w-737x-v2c9. The CVSS v3.1 base score is 5.9 (Moderate) per the official GitHub advisory, though NVD estimates it at 7.5 (High) (Github Advisory, ImageMagick Advisory).

The root cause is an integer truncation/wraparound (CWE-190: Integer Overflow or Wraparound) in the WriteVIFFImage function within coders/viff.c. On 32-bit builds, the packets variable — a MagickSizeType value — is cast to size_t for memory allocation; when the value exceeds the 32-bit size_t maximum, it wraps around to a smaller value, causing AcquireVirtualMemory to allocate an undersized buffer. Subsequent writes to this buffer result in an out-of-bounds heap write (CWE-787). The fix, committed in d27b840, adds a bounds check: if (packets != (MagickSizeType) ((size_t) packets) before the allocation, throwing a ResourceLimitError if truncation would occur (ImageMagick Commit, ImageMagick Advisory).

Successful exploitation results in an out-of-bounds heap write that causes a crash of the ImageMagick process, leading to a denial of service condition. The impact is limited to availability — there is no confidentiality or integrity impact identified. The vulnerability is only exploitable on 32-bit builds of ImageMagick, which limits the affected population, and there is no evidence of code execution potential beyond a crash (Github Advisory, ImageMagick Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-33900. The EPSS score is approximately 0.02% (6th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the target to be running a 32-bit build of ImageMagick and processing a specially crafted VIFF image, which adds complexity (Github Advisory).

1. Identify target: Locate a service or application running a 32-bit build of ImageMagick (versions below 6.9.13-44 or 7.x below 7.1.2-19) that accepts user-supplied image files for processing.
2. Craft malicious VIFF image: Create a specially crafted VIFF image file where the computed packets value (used for pixel buffer allocation) is large enough to overflow a 32-bit size_t when cast, causing integer wraparound.
3. Submit the image: Upload or submit the crafted VIFF file to the target application, triggering ImageMagick's WriteVIFFImage function to process it.
4. Trigger heap overflow: The truncated packets value causes an undersized heap buffer to be allocated; subsequent pixel data writes overflow the buffer, resulting in a crash (denial of service) (ImageMagick Advisory, ImageMagick Commit).

• Logs: Unexpected ResourceLimitError or MemoryAllocationFailed errors in ImageMagick logs when processing VIFF image files; application crash logs or core dumps associated with the ImageMagick process.
• Process: Abnormal termination (segmentation fault or abort signal) of the ImageMagick process (convert, magick, or embedding application) when handling VIFF-format files.
• File System: Presence of unusual or oversized .viff or .vif image files submitted by external users in upload directories or temporary processing folders.

Upgrade ImageMagick to version 7.1.2-19 or 6.9.13-44, which include the fix for this vulnerability. For .NET applications using Magick.NET, upgrade to version 14.12.0 or later. As a workaround where upgrading is not immediately possible, restrict or disable processing of VIFF image files (e.g., via ImageMagick's policy.xml to deny the VIFF format), or avoid deploying 32-bit builds of ImageMagick. OpenSUSE and Debian have also released distribution-level security updates addressing this issue (ImageMagick Release, Magick.NET Release, Github Advisory).

Red Hat tracked the vulnerability via Bugzilla (bug #2458020) and published a CVE advisory page. OpenSUSE issued security announcements for affected packages. Debian issued security advisories (DSA-6240-1 and DLA-4559-1) addressing ImageMagick. Coverage has been limited to standard vulnerability tracking outlets with no notable researcher commentary or social media discussion beyond routine disclosure (Red Hat Bugzilla).