5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33905

CVE-2026-33905: ImageMagick has an Out-of-Bounds read via -sample operation

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the -sample operation has an out of bounds read when an specific offset is set through the sample:offset define that could lead to an out of bounds read. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33905

CVE-2026-33905:

5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-x86	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-OpenMP-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-x86	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-AnyCPU	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-OpenMP-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-x86	nuget	< 14.12.0	14.12.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the SampleImage function in MagickCore/resize.c. The root cause is an out-of-bounds read that can be triggered when processing an image with the -sample operation and a crafted sample:offset value. The provided commit cca607366fb38c2dde019a9088b8415ffba3a835 clearly shows the changes made to this function to fix the vulnerability. The original code calculated offsets and stored them in an array, which was then used to access pixel data from a row buffer. A malicious offset could lead to accessing data outside of this buffer. The fix involves calculating the offset and fetching the corresponding pixel one by one inside the loop, which prevents the out-of-bounds read. Therefore, any runtime profile during the exploitation of this vulnerability would show the SampleImage function.

Vulnerable functions

SampleImage

MagickCore/resize.c

The `SampleImage` function was vulnerable to an out-of-bounds read. Before the patch, the function pre-calculated an array of x-offsets and then fetched a complete row of pixels from the source image. A specially crafted `sample:offset` could cause the calculated x-offsets to point outside the bounds of the fetched pixel row, leading to a read of memory outside the buffer when `SetPixelChannel` was called. The patch mitigates this by calculating the source pixel offset inside the loop for each destination pixel and fetching only the single required pixel, which is a safer approach.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.