CVE-2026-105826 in ImageMagick
Summary
by MITRE • 10/08/2026
ImageMagick before 6.9.13-55 and 7.x before 7.1.2-30 contains a security policy bypass in the MAT decoder, which does not enforce configured temporary file size limits when reading highly compressed data. Attackers can supply a crafted MAT image whose decompressed data is written to temporary files larger than the policy allows, consuming disk resources.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in ImageMagick versions prior to 6.9.13-55 and 7.x before 7.1.2-30 represents a critical security policy bypass within the MAT image decoder module. This flaw stems from an inconsistency in how temporary file size limits are enforced during the decompression process of highly compressed data streams. Specifically, while ImageMagick’s configuration allows administrators to set strict quotas on the amount of disk space that can be consumed by temporary files generated during image processing operations, this enforcement mechanism fails when handling MAT format inputs. The decoder does not properly validate or restrict the size of these intermediate temporary files before they are written to storage, effectively allowing an attacker to circumvent configured security policies through carefully crafted input data.
From a technical perspective, the core issue lies in the decompression logic associated with the MAT codec. When ImageMagick processes an image file, it often creates temporary working copies or buffers on disk rather than holding all data in memory, particularly for large images or complex operations. The security policy is designed to prevent denial-of-service attacks by limiting resource consumption via these temporary files. However, because the MAT decoder does not enforce these limits during the expansion of compressed payloads, an attacker can supply a maliciously crafted MAT image file that appears small on disk but expands into significantly larger data structures when decompressed. This discrepancy allows the resulting temporary files to exceed the allocated size thresholds defined in the ImageMagick configuration, leading to uncontrolled resource consumption.
The operational impact of this vulnerability is primarily centered around denial-of-service conditions and potential system instability. By exploiting this policy bypass, an attacker can cause a remote or local service utilizing ImageMagick to consume excessive disk space rapidly. This exhaustion of available storage resources can lead to the failure of legitimate image processing tasks, corruption of other data stored on the affected volume, or complete unavailability of services that depend on functional temporary file creation. In environments where ImageMagick is used in a server-side capacity, such as web applications allowing user-uploaded images for conversion or analysis, this vulnerability can be leveraged to disrupt service availability without requiring authentication if input validation is insufficiently robust at the application layer.
This flaw aligns with CWE-787: Out-of-bounds Write and CWE-403: Exposure of File Descriptor to Unintended Control Entity in terms of resource management failures, though it most directly maps to CWE-770: Allocation of Resources Without Limits or Throttling. The attack vector is consistent with ATT&CK technique T1496: Resource Hijacking, where an adversary consumes system resources to degrade performance or availability. It also reflects aspects of CWE-20: Improper Input Validation, as the decoder fails to adequately validate the expected size relationship between compressed input and decompressed output against configured security constraints.
Mitigation strategies for this vulnerability involve immediate software updates and configuration hardening. The primary remediation is upgrading ImageMagick to version 6.9.13-55 or later, or version 7.1.2-30 and above, where the MAT decoder has been patched to correctly enforce temporary file size limits during decompression operations. For systems that cannot be immediately updated, administrators should review their image processing pipelines for input validation mechanisms that check file sizes before passing them to ImageMagick libraries. Additionally, enforcing strict disk quotas at the operating system level can provide a secondary layer of defense by limiting the maximum space any single process or user account can consume on specific volumes. Regular auditing of security policy configurations and ensuring they are applied consistently across all codec modules is also recommended to prevent similar bypasses in other image formats supported by the library.