Security readout for executives and security teams
Plain-English summary
CVE-2026-27799 affects ImageMagick’s handling of DJVU images. A calculation error can cause the program to read outside an allocated memory buffer. The published severity is medium, with limited integrity and availability impact. Organizations that process DJVU files, especially from untrusted sources, should prioritize updating ImageMagick.
Executive priority
Treat this as a targeted update priority, not an emergency. Patch internet-facing or automated file-processing services first, especially where users can upload documents or images. The available evidence shows a medium-severity memory safety issue with a published fix and no confirmed active exploitation.
Technical view
Before ImageMagick 7.1.2-15 and 6.9.13-40, the DJVU handler can miscalculate pixel buffer stride due to integer truncation and 32-bit signed integer overflow. This can produce heap out-of-bounds reads. The CVE lists CWE-122 and CWE-126, CVSS 3.1 score 4.0, vector AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L.
Likely exposure
Exposure is most likely where ImageMagick processes DJVU files, including image conversion services, document pipelines, content ingestion systems, or applications bundling ImageMagick. The source bundle names ImageMagick as affected; it also references Magick.NET, but does not provide enough detail here to assert separate affected versions.
Exploitation context
No active exploitation is indicated in the provided sources, and the CVE is not marked KEV. The CVSS vector rates attack complexity high and attack vector local. Practical risk is higher for systems that automatically process untrusted DJVU files with vulnerable ImageMagick versions.
Researcher notes
The core issue is integer truncation in DJVU stride calculation leading to heap buffer over-read. Impact is constrained by the published CVSS: no confidentiality impact, low integrity and availability impact, high attack complexity. Avoid assuming remote exploitability beyond the scored vector and vendor advisory details.
Mitigation direction
- Upgrade ImageMagick 7.x to 7.1.2-15 or later.
- Upgrade ImageMagick 6.x to 6.9.13-40 or later.
- Check vendor guidance for downstream packages that bundle ImageMagick.
- Restrict or disable DJVU processing where updates cannot be applied promptly.
- Prioritize systems handling user-supplied or third-party image files.
Validation and detection
- Inventory ImageMagick installations and embedded library usage.
- Confirm installed versions are not below fixed releases.
- Identify workflows that accept or convert DJVU files.
- Review container images and application dependencies for bundled ImageMagick.
- Monitor ImageMagick advisory channels for updated guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-122: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-126: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-27799 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L1.42.5Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4MediumVector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r99p-5442-q2x2CVE reference · x_refsource_CONFIRM
- https://github.com/ImageMagick/ImageMagick/commit/e87695b3227978ad70b967b8d054baaf8ac2ccedCVE reference · x_refsource_MISC
- https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Heap-based Buffer Overflow
Heap-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Buffer Over-read
Buffer Over-read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.