CVE-2026-109964
ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds
CVSS
5.6
Média
EPSS
0.3%
p28
KEV
—
Exploit Today
8
0-100
Publicado: 13 de out. de 2026 · Última mod.: 3 de nov. de 2026 · CWE-124
0.3%EPSS · 30 dias0.4%
2026-10-142026-11-05
ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution.
- github.comhttps://github.com/ImageMagick/ImageMagick
- github.comhttps://github.com/ImageMagick/ImageMagick/blob/7.1.2-32/coders/pict.c#L503-L540
- github.comhttps://github.com/ImageMagick/ImageMagick/commit/63dde0cf281383ab69432b88305f7dcd6a8ce900
- github.comhttps://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqmp-r5jh-jx7w
- github.comhttps://github.com/ImageMagick/ImageMagick6/commit/c18c5d5fb7f1d87ddbe0a02e9d1207c89b24588c
- www.vulncheck.comhttps://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-and-6.9.13-58-heap-buffer-underwrite-in-pict-decoder
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-125385.4 MÉD26.7%
——8IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields.1dCVE-2026-970088.8 ALT58.6%
——18Buffer underwrite ('buffer underflow') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.21dCVE-2026-1094485.9 MÉD13.0%
——4Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt heap memory. psqlODBC stores the binding count in a signed 16-bit field. Binding parameter number 32768 wraps that count to -32768. Binding parameter 32769 then writes about 2.5 MB of zeros starting 1.25 MB before the binding array, which crashes the application or leaves it running on a corrupted heap. Applications that build parameter lists from untrusted input, such as an IN (?, ?, ...) list, are exposed. Versions before psqlODBC 18.00.0005 are affected.21dCVE-2026-161797.5 ALT25.6%
——8IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a heap buffer underwrite and potentially crash the service.22dCVE-2026-400134.3 MÉD58.9%
——18An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. This causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of service for script management. This might be able to be used for remote code execution. Disable the ManageSieve service if users do not need remote Sieve script management. Update to non-vulnerable version. No publicly available exploits are known.64dCVE-2026-730753.9 BAI0.6%
——0Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.31d