CVE-2026-33854 is an out of bounds write in the Android-ImageMagick7 library. NVD scores it 8.8. It affects versions before 7.1.2-10. Update the library and rebuild any Android app that bundles it. The bug sits in WebP decoding code that was copied from another project.
What's affected
The record says Android-ImageMagick7 before 7.1.2-10 is affected. The referenced pull request, number 184, describes a fix for an out of bounds write in BuildHuffmanTable, in bundled libwebp 1.0.3 code that did not receive the upstream patch, and links CVE-2023-4863. That is the PR author's account, so confirm details against the project's release notes.
How to check if you're exposed
Look at your Gradle dependencies:
./gradlew app:dependencies | grep -i imagemagick
Compare the version with 7.1.2-10. Also check native libraries in built APKs, since the vulnerable code is compiled in.
What to do now
- Update to 7.1.2-10 or later and rebuild.
- Ship an app update, since users stay on the old native code until they update.
- Avoid decoding untrusted WebP images with the old library meanwhile.
- Inventory libraries that vendor copies of other projects.
Why it matters
The record uses CWE-787, out of bounds write. Memory writes past a buffer can corrupt data or enable code execution. The case shows how a fixed upstream bug survives in a vendored copy. Scanners that read lockfiles may miss it, so track bundled native code. The record is not marked as exploited in the wild and is not in CISA KEV.
For teams that ship mobile apps, the practical issue is the update cycle. A library fix does nothing for users until your app update reaches them, so plan the release, not only the dependency bump. If you cannot tell which of your apps bundle this library, search your build outputs for the native library names and your Gradle files for the dependency, and record the result in your inventory so the next advisory is a lookup instead of a hunt.
Quick check
Why did an old libwebp bug appear here?
The pull request says the project cloned libwebp code that missed the upstream patch.
Sources
Last reviewed: 19 October 2026.
