Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-109964

ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 30.0%
CVSS Severity
CVSS v3 Score 5.6
Products affected by CVE-2026-109964


Contact Us

Shodan ® - All rights reserved