Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-33854: MolotovCherry Android-ImageMagick7 can overwrite memory

CVE-2026-33854 · published 7 months ago

Summary

The Android version of ImageMagick provided by MolotovCherry (up to version 7.1.2-9) allows data to be written outside the intended memory area. This could let an attacker corrupt the app or gain control of the device. Update to version 7.1.2-10 or later to fix the issue.

What to do

Update molotovcherry android-imagemagick7 to version 7.1.2-10 or later.

Affected software

Vendor	Product	Affected versions
molotovcherry	android-imagemagick7	< 7.1.2-10 `cpe:2.3:a:molotovcherry:android-imagemagick7::::::::`

Original advisory text

Out-of-bounds Write in MolotovCherry Android-ImageMagick7

Out-of-bounds Write vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-10.

References

https://github.com/MolotovCherry/Android-ImageMagick7/pull/184 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33854... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33854 Vendor Advisory
https://github.com/MolotovCherry/Android-ImageMagick7 Product

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published24 Mar 2026

Updated4 Nov 2026

First seen24 Mar 2026

Sources

CVE-2026-33854 · NVD

CVE-2026-33854 · OSV

Track software like this

Free during beta