Junglewise Threat Intelligence

CVE-2026-33900: ImageMagick integer overflow in VIFF encoder

CVE-2026-33900 · Severity: medium · CVSS 5.9 · Published 2026-04-13

Technologies: Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet), Magick.NET-Q8-x86 (NuGet), Magick.NET-Q8-AnyCPU (NuGet), Magick.NET-Q16-HDRI-x86 (NuGet), Magick.NET-Q16-x86 (NuGet). Vendors: NuGet.

Executive brief

ImageMagick contains an integer truncation/wraparound vulnerability in its VIFF encoder on 32-bit builds, which can lead to an out-of-bounds heap write and application crash.

Affected products

  • NuGet Magick.NET-Q16-AnyCPU
  • NuGet Magick.NET-Q16-HDRI-AnyCPU
  • NuGet Magick.NET-Q8-x86
  • NuGet Magick.NET-Q8-AnyCPU
  • NuGet Magick.NET-Q16-HDRI-x86
  • NuGet Magick.NET-Q16-x86

References

Related threats