CVE-2026-119124 in ImageMagick
Summary
by MITRE • 10/29/2026
ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the application.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
ImageMagick is a widely used open-source software suite for creating, editing, composing, or converting bitmap images. It supports over 200 major file formats and is commonly integrated into web applications, content management systems, and automated image processing pipelines. The vulnerability identified in versions prior to 7.1.2-34 resides within the -morph command-line option, which applies various morphing effects such as shear, rotate, or scale transformations to images. This specific flaw manifests as a heap-based buffer overflow during the memory allocation and data copying phases associated with processing these morph operations on specially crafted input files.
The technical root cause of this vulnerability is an improper boundary check within the image processing engine when handling certain malformed inputs. When ImageMagick processes an image using the -morph option, it allocates a heap buffer to store intermediate pixel data or transformed coordinates. Due to insufficient validation of the dimensions and stride values derived from the input file header, the software calculates an incorrect size for this allocation. Consequently, subsequent write operations exceed the allocated memory bounds, leading to corruption of adjacent heap metadata or application-specific structures. This out-of-bounds write condition allows an attacker who can supply a crafted image to overwrite critical data in the process's memory space.
From an operational perspective, the immediate impact of exploiting this vulnerability is typically a denial of service through application crash. The heap corruption triggers segmentation faults or other fatal errors that terminate the ImageMagick process. However, given the nature of heap-based buffer overflows, there is also a significant potential for remote code execution if the attacker can precisely control the overwritten memory contents and exploit specific allocator behaviors to gain arbitrary write primitives. This risk is heightened in server-side environments where ImageMagick processes user-uploaded images automatically without manual review or strict size constraints.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-122, which describes a heap-based buffer overflow allowing writes beyond the bounds of a memory allocation assigned to a buffer. In terms of attack vectors and techniques, this flaw facilitates exploitation consistent with MITRE ATT&CK technique T1059, specifically command execution via system utilities or script interpreters if ImageMagick is invoked in contexts that allow shell escapes, although the primary vector here is direct application compromise through memory corruption. The lack of rigorous input validation on image dimensions and stride parameters represents a classic failure in boundary condition handling common in legacy C/C++ codebases.
To mitigate this risk, organizations must immediately upgrade to ImageMagick version 7.1.2-34 or later, where the heap allocation logic has been corrected with proper bounds checking. For environments that cannot be patched instantly, implementing strict input validation at the application layer is critical. This includes limiting image file sizes, restricting allowed morph operations via policy.xml configurations, and ensuring that ImageMagick runs under restricted user privileges to minimize the impact of a potential compromise. Additionally, deploying web application firewalls or custom middleware to sanitize uploaded images before they reach the processing engine can provide an additional layer of defense against crafted payloads designed to trigger this overflow condition.