CVE-2026-116142

What it actually does

Heap buffer over-read in ImageMagick's minimum-bounding-box output routine that reads past the end of allocated memory when processing a crafted image, resulting in crashes or exposure of adjacent heap contents.

Why it matters to the business

Applications using the library may crash during routine image handling or inadvertently leak fragments of process memory, disrupting services and creating a potential data exposure path.

How an attack unfolds

An attacker creates a malformed image file engineered to trigger the minimum-bounding-box code path; the file is supplied to any application that invokes ImageMagick for image analysis or rendering, causing the over-read during box calculation.

How to fix it

Upgrade ImageMagick to version 7.1.2-33 or newer; rebuild and redeploy any dependent applications or containers against the patched library.

How to confirm the fix worked

Verify installed ImageMagick version is 7.1.2-33 or later; run regression tests with known-triggering images to confirm absence of crashes or memory disclosure.

Typical attack path

1. Generate a crafted image that exercises the vulnerable bounding-box routine
2. Deliver the image to a target application that uses the vulnerable ImageMagick version
3. Trigger image processing that invokes minimum-bounding-box output
4. Observe process crash or capture leaked heap memory

How to detect it

Search application and system logs for ImageMagick-related segmentation faults or abnormal terminations during image processing; inspect core dumps or memory artifacts around image-handling routines for signs of unexpected memory access.

What your security team should do

• Immediately inventory all systems and containers for ImageMagick versions prior to 7.1.2-33
• Prioritize upgrade to 7.1.2-33 across development, staging, and production environments
• Add version checks and automated rebuild steps to CI/CD pipelines
• Monitor application logs for segmentation faults or image-processing crashes