CVE-2026-116149 in ImageMagick
Summary
by MITRE • 10/25/2026
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified as CVE-2024-26135 represents a critical security flaw within the ImageMagick software suite, specifically affecting versions prior to 6.9.13-58 and 7.x prior to 7.1.2-33. This issue stems from improper memory management during the processing of bzip2 compressed image files. The core technical defect is a stack-based buffer overflow that occurs when the library attempts to decode images utilizing the bzip2 compression algorithm. In this scenario, an attacker can craft a maliciously constructed image file containing specially designed data payloads. When ImageMagick processes this crafted input, it fails to adequately validate or bound-check the size of the incoming compressed stream against the allocated stack memory buffers. Consequently, the decoding routine writes more data than the buffer can hold, causing adjacent memory locations on the call stack to be overwritten with attacker-controlled values.
This type of vulnerability is classified under CWE-121, which denotes a stack-based buffer overflow. Such flaws are particularly dangerous because they allow for arbitrary code execution or denial of service conditions depending on how the corrupted data interacts with other system components. The operational impact of this flaw includes application crashes due to segmentation faults when memory corruption disrupts critical control flow structures like return addresses and saved frame pointers. In more severe cases, sophisticated exploitation techniques could enable remote code execution by overwriting function pointers or injecting shellcode into the stack space. This poses a significant risk for any service that accepts user-uploaded images from untrusted sources without rigorous sanitization prior to processing.
From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK technique T1203, which covers Exploitation for Client Execution, as well as aspects of T1496, Resource Hijacking if the crash leads to resource exhaustion in a server environment. The ability to trigger memory corruption through file parsing is a common attack vector used by threat actors targeting multimedia processing libraries that are often integrated into web applications and content management systems. Attackers typically exploit such weaknesses by hosting malicious files on external servers or embedding them within emails, waiting for victims to upload the images to vulnerable services running ImageMagick.
Mitigation strategies must prioritize immediate software updates. Administrators should upgrade ImageMagick to version 6.9.13-58 or later for legacy systems, and version 7.1.2-33 or later for modern deployments where these patches address the bounds checking logic in the bzip2 decoder module. In environments where upgrading is not immediately feasible, implementing strict input validation at the network perimeter can provide a layer of defense. This includes restricting file uploads to trusted formats only and ensuring that any image processing occurs within isolated containers with limited system privileges. Additionally, enabling Address Space Layout Randomization (ASLR) and stack protectors in compiler configurations can mitigate the likelihood of successful code execution by making memory layout unpredictable and detecting buffer overflows before they compromise control flow integrity.