ImageMagick before version 7.1.2.35-1.oe2403sp3 contains a heap-based buffer overflow vulnerability in its -morph image processing feature. This flaw allows an attacker to supply a crafted image that causes writes beyond the bounds of a heap buffer, potentially corrupting memory and crashing the application. The issue has been assigned CVE-2026-119124 and has a medium severity rating with a CVSS score of 4.8. A fix is available in version 7.1.2.35-1.oe2403sp3.