5.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31853

CVE-2026-31853: ImageMagick has a heap buffer over-write on 32-bit systems in SFW decoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-16 and 6.9.13-41, an overflow on 32-bit systems can cause a crash in the SFW decoder when processing extremely large images. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31853

CVE-2026-31853:

5.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.10.4	14.10.4
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.10.4	14.10.4
Magick.NET-Q16-HDRI-OpenMP-arm64

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis began by examining the provided reference URLs, which pointed to a security advisory for ImageMagick (GHSA-56jp-jfqg-f8f4). The advisory described a heap buffer overflow in the SFW decoder on 32-bit systems. The patched versions were identified as 7.1.2-16 and 6.9.13-41. By inspecting the commit history of the ImageMagick/ImageMagick repository between the vulnerable version 7.1.2-15 and the patched version 7.1.2-16, a specific commit was found with the message: "Corrected the overflow check that can cause issues on 32-bit systems (GHSA-56jp-jfqg-f8f4)". This commit, 7936d9c7bec4bd459a8d4b5304a1a6fbf7dac0ea, directly addresses the vulnerability. The patch modifies the coders/sfw.c file within the ReadSFWImage function. The change corrects the logic for checking the image size before allocating memory. The vulnerable code had a faulty check for integer overflows on 32-bit platforms, which could lead to allocating an insufficiently sized buffer. The subsequent attempt to read the image data into this buffer would cause a heap overflow. Therefore, the ReadSFWImage function is the identified vulnerable function.

Vulnerable functions

ReadSFWImage

coders/sfw.c

The vulnerability lies in the `ReadSFWImage` function, which is responsible for decoding SFW (Seattle FilmWorks) image files. On 32-bit systems, an integer overflow could occur when calculating the buffer size for very large images. The original size check, `GetBlobSize(image) != (size_t) GetBlobSize(image)`, was insufficient to prevent the overflow. This could lead to a smaller-than-required buffer being allocated via `AcquireQuantumMemory`. When the function proceeds to read the image data into this undersized buffer using `ReadBlob`, a heap-based buffer overflow occurs, which could lead to a crash or potentially arbitrary code execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.