CVE-2026-116142 in ImageMagick
Summary
by MITRE • 10/25/2026
ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printing a minimum-bounding-box. Attackers can supply a crafted image that triggers the over-read during minimum-bounding-box output, causing crashes or exposing adjacent heap memory.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/25/2026
ImageMagick is a widely used open-source software suite for creating, editing, and converting bitmap images across various formats. The vulnerability identified in versions prior to 7.1.2-33 represents a critical security flaw within the image processing engine, specifically affecting the logic responsible for calculating minimum bounding boxes. A heap buffer over-read occurs when a program reads data from memory locations that are beyond the allocated boundaries of a buffer on the heap. In this specific context, the vulnerability is triggered during the execution of operations that require determining the spatial extent or dimensions of an image object, commonly referred to as printing or computing the minimum-bounding-box. This function iterates through pixel data or structural metadata to find the outermost non-transparent pixels, and due to improper boundary checks, it accesses memory addresses outside the intended allocation.
The technical root cause lies in insufficient validation of array indices or pointer arithmetic during the bounding box calculation routine. When a crafted image is processed, particularly one with specific dimensions or pixel configurations that edge-case the loop conditions, the software fails to verify that the current index remains within the bounds of the allocated heap memory segment. Consequently, the application reads adjacent memory contents which may contain sensitive information such as other objects' data, stack pointers, or internal state variables. This behavior aligns with Common Weakness Enumeration standard CWE-125, which describes out-of-bounds read vulnerabilities where software does not properly validate array indices before accessing them. The flaw is particularly dangerous because it allows for non-destructive memory disclosure without necessarily crashing the application immediately, although crashes are a frequent secondary effect due to subsequent operations attempting to use corrupted or invalid data pointers.
The operational impact of this vulnerability extends beyond simple denial of service through application crashes. While an attacker can force ImageMagick to terminate unexpectedly by triggering segmentation faults via malformed inputs, the more severe risk involves information disclosure. By carefully crafting input images and analyzing the output or side-channel effects, a remote attacker could potentially exfiltrate sensitive data residing in adjacent heap memory. This could include authentication tokens, private keys, or other proprietary image metadata processed previously by the same instance of ImageMagick. In environments where ImageMagick is deployed as part of a web service or backend API that processes user-uploaded images, this vulnerability can be exploited remotely over a network without requiring any prior authentication. The ability to read arbitrary memory locations undermines the confidentiality guarantees expected in secure software design and poses significant risks for applications handling sensitive visual data.
From an offensive security perspective, this flaw maps directly to MITRE ATT&CK technique T1083, which covers File and Directory Discovery, although more accurately it aligns with T1567 Exfiltration Over Web Service if used in a networked context where the read memory is transmitted back to the attacker. The exploitation vector typically involves submitting specially constructed image files through any interface that invokes ImageMagick's bounding box calculation features. Mitigation strategies primarily focus on immediate patching, as version 7.1.2-33 and later releases contain fixes for this boundary check logic. Organizations relying on ImageMagick should prioritize upgrading their dependencies to the patched versions immediately. Additionally, implementing strict input validation at the application layer before passing images to the library can provide a defense-in-depth measure. Deploying Web Application Firewalls with rules capable of detecting anomalous image processing requests may also help mitigate exploitation attempts in production environments where immediate patching is not feasible. Regular security audits and static code analysis tools configured to detect out-of-bounds access patterns are recommended to prevent similar vulnerabilities from being introduced during future development cycles.