Brief Summary: ImageMagick CVE-2026-33901 Heap Buffer Overflow in MVG Decoder

Introduction

A heap buffer overflow in ImageMagick's MVG (Magick Vector Graphics) decoder allows unauthenticated attackers to crash image processing services by submitting a single crafted image file. ImageMagick is embedded in web backends, content management systems, and automated pipelines across the internet, so this CVSS 7.5 vulnerability is a meaningful availability risk for any service that processes untrusted image uploads with the MVG coder enabled.

Technical information

CVE-2026-33901 comes from insufficient bounds checking in the MVG decoder, specifically in the RenderMVGContent function in MagickCore/draw.c. The vulnerability is classified under CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). When ImageMagick parses a maliciously crafted MVG image, the decoder writes data past the end of an allocated heap buffer and corrupts memory.

The vulnerable code path

Before the fix, the RenderMVGContent function only checked the variable q for a NULL pointer while parsing MVG content. That check did not stop writes beyond the allocated MagickPathExtent boundary. The patch in commit 4c72003e9e54a4ebaa938d239e75f5d285527ebe adds an explicit length check:

if ((q == (char *) NULL) || ((q - p + 4 + 1) > MagickPathExtent))
{
  status = MagickFalse;
  break;
}

The new condition ((q - p + 4 + 1) > MagickPathExtent) ensures that the distance between the current write position and the start of the buffer, plus the bytes about to be written, does not exceed the defined boundary. If crafted input tries to push past this limit, the function stops safely by setting status to MagickFalse and breaking out of the processing loop.

CVSS vector breakdown

The CVSS 3.1 base score of 7.5 breaks down as follows:

Attack flow

An attacker would follow a straightforward path:

1. Craft a malicious MVG image file that produces input exceeding the MagickPathExtent boundary during parsing in RenderMVGContent.
2. Submit the file to any service that accepts image uploads and processes them through a vulnerable version of ImageMagick with the MVG coder enabled. This could be a web application's image upload endpoint, a CMS thumbnail generator, or a backend worker queue.
3. When ImageMagick processes the file, the heap buffer overflow triggers and the process crashes. Repeated submissions could sustain a denial-of-service condition.

Dependency impact

The attack surface extends beyond direct ImageMagick installations. Wrapper libraries that bundle or depend on ImageMagick are equally affected. The popular .NET wrapper Magick.NET explicitly references this vulnerability (GHSA-x9h5-r9v2-vcww) in its release notes, and users must update to version 14.12.0 to get the upstream fix. Any language binding or container image that ships a vulnerable ImageMagick version has the same exposure.

Affected systems and versions

The following components and version ranges are affected:

Any application, container image, or CI/CD pipeline that includes an unpatched version of these components and processes untrusted MVG input is vulnerable.

Where immediate patching is not possible, disabling the MVG coder in ImageMagick's policy.xml is an effective interim mitigation:

<policymap>
  <policy domain="coder" rights="none" pattern="MVG" />
</policymap>

Further hardening measures include restricting ImageMagick to web-safe formats (GIF, JPEG, PNG), enforcing resource limits, sandboxing the process, and validating magic bytes on every uploaded file before processing.

Vendor security history

ImageMagick's extensive format support has long been a source of security issues. The most significant prior incident was CVE-2016-3714, widely known as "ImageTragick," which allowed remote code execution through improper sanitization of shell commands during image processing. That vulnerability led to widespread adoption of policy.xml hardening. The vendor and the security community specifically recommended disabling the MVG, EPHEMERAL, URL, and MSL coders on public-facing services.

A decade later, CVE-2026-33901 appears in the same MVG decoder, which shows that the MVG coder is still a high-risk component. Organizations that followed the post-ImageTragick guidance and disabled MVG processing would already be protected against this new vulnerability. That is a strong case for a default-deny policy on non-essential image formats.

References

• NVD: CVE-2026-33901
• CVE Record: CVE-2026-33901
• GitHub Security Advisory GHSA-x9h5-r9v2-vcww
• ImageMagick Commit 4c72003
• Magick.NET 14.12.0 Release Notes
• ImageMagick Security Policy Documentation
• ImageTragick (CVE-2016-3714)
• ImageMagick GitHub Repository