Security Vulnerability Report
中文
CVE-2026-33852 CVSS 7.5 HIGH

CVE-2026-33852

Published: 2026-03-24 07:16:07
Last Modified: 2026-03-26 19:06:14

Description

Missing Release of Memory after Effective Lifetime vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.

CVSS Details

CVSS Score
7.5
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:a:molotovcherry:android-imagemagick7:*:*:*:*:*:*:*:* - VULNERABLE
Android-ImageMagick7 < 7.1.2-11

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// PoC Concept for CVE-2026-33852 // This script demonstrates triggering the memory leak by processing images repeatedly. public class MemoryLeakPoC { public static void main(String[] args) { // Simulate processing a crafted image that triggers the leak for (int i = 0; i < 10000; i++) { try { // Load a vulnerable image resource ImageMagick image = new ImageMagick("crafted_image.png"); // Perform operation that triggers the memory leak image.processImage(); // Memory is not released here due to the vulnerability } catch (Exception e) { System.err.println("Error processing image: " + e.getMessage()); } } System.out.println("PoC executed. Monitor memory usage for increase."); } }

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-33852", "sourceIdentifier": "[email protected]", "published": "2026-03-24T07:16:07.163", "lastModified": "2026-03-26T19:06:14.017", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Release of Memory after Effective Lifetime vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11."}, {"lang": "es", "value": "Vulnerabilidad por ausencia de liberación de memoria después de la vida útil efectiva en MolotovCherry Android-ImageMagick7. Este problema afecta a Android-ImageMagick7: antes de 7.1.2-11."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-401"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:molotovcherry:android-imagemagick7:*:*:*:*:*:*:*:*", "versionEndExcluding": "7.1.2-11", "matchCriteriaId": "CD4FC35B-5E60-42CC-87A5-71FF393A6EAB"}]}]}], "references": [{"url": "https://github.com/MolotovCherry/Android-ImageMagick7/pull/191", "source": "[email protected]", "tags": ["Issue Tracking"]}]}}