Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-33855: MolotovCherry Android-ImageMagick7 miscalculates image sizes

CVE-2026-33855 · published 7 months ago

Summary

The Android version of ImageMagick provided by MolotovCherry can add numbers incorrectly when processing certain images, causing values to wrap around. This can lead to crashes or allow attackers to manipulate image handling. Upgrade to a version later than 7.1.2-11 or apply the vendor’s patch as soon as possible.

What to do

Update molotovcherry android-imagemagick7 to version 7.1.2-11 or later.

Affected software

Vendor	Product	Affected versions
molotovcherry	android-imagemagick7	< 7.1.2-11 `cpe:2.3:a:molotovcherry:android-imagemagick7::::::::`

Original advisory text

Integer Overflow or Wraparound in MolotovCherry Android-ImageMagick7

Integer Overflow or Wraparound vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.

References

https://github.com/MolotovCherry/Android-ImageMagick7/pull/187 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33855... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33855 Vendor Advisory
https://github.com/MolotovCherry/Android-ImageMagick7 Product

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-190Integer Overflow

Timeline

Published24 Mar 2026

Updated29 Oct 2026

First seen24 Mar 2026

Sources

CVE-2026-33855 · NVD

CVE-2026-33855 · OSV

Track software like this

Free during beta