5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33900

CVE-2026-33900: ImageMagick has a heap overflow caused by integer overflow/wraparound in viff encoder on 32-bit builds

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the viff encoder contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out of bounds heap write, potentially causing a crash. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33900

CVE-2026-33900:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-x86	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-x86	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-AnyCPU	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-x86	nuget	< 14.12.0	14.12.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided vulnerability information and the associated commit d27b840a61b322419a66d0d192ff56d52498148d directly points to the WriteVIFFImage function in coders/viff.c as the source of the vulnerability. The patch itself is the primary evidence, showing the addition of a check to prevent an integer overflow before a memory allocation call. The vulnerability description perfectly aligns with the code change: an integer truncation issue on 32-bit builds leading to a heap overflow in the viff encoder. The modified function, WriteVIFFImage, is responsible for writing VIFF images and is where the vulnerable memory allocation occurs. Therefore, this function would be present in any runtime profile or stack trace when the vulnerability is triggered.

Vulnerable functions

WriteVIFFImage

coders/viff.c

The function `WriteVIFFImage` in `coders/viff.c` is vulnerable to an integer overflow. The vulnerability exists because on 32-bit systems, the `packets` variable (of type `MagickSizeType`) can hold a value larger than what `size_t` can represent. When `packets` is cast to `size_t` for the `AcquireVirtualMemory` call, the value is truncated, leading to a smaller memory buffer being allocated than what is actually required. When the application attempts to write the pixel data, it writes past the end of this undersized buffer, resulting in a heap-based buffer overflow. The patch mitigates this by adding a check to ensure that the value of `packets` does not change when cast to `size_t`, thus preventing the allocation of a truncated buffer size.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.