Cloudanix VulnDB

CVE-2026-116149

High · 8.1

CVSS

8.1

EPSS

0.3%

Published

Oct 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Image software can be tricked by specially made picture files into crashing or allowing memory damage, which could disrupt services that handle photos or graphics.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Stack-based buffer overflow during decoding of bzip2-compressed images allows an attacker to overwrite adjacent stack memory, resulting in process crashes or memory corruption.

Why it matters to the business

Organizations relying on image processing pipelines face immediate risk of service outages and potential compromise of systems handling untrusted images, with remediation required within days of disclosure.

How an attack unfolds

An attacker creates a specially crafted image file that uses bzip2 compression, then causes a vulnerable ImageMagick installation to decode the file, triggering the overflow during decompression.

How to fix it

Upgrade ImageMagick to version 6.9.13-58 or newer for the 6.x series and 7.1.2-33 or newer for the 7.x series. Where immediate upgrade is not possible, disable bzip2 support or restrict processing of compressed image formats from untrusted sources.

How to confirm the fix worked

Verify installed ImageMagick version against the fixed releases using the identify -version command or equivalent package manager query; test image decoding with known-good and boundary-case bzip2 images in a lab environment.

Typical attack path

  1. Create malicious image file using bzip2 compression that exceeds expected buffer sizes
  2. Deliver the crafted image to an application or service that invokes ImageMagick for decoding
  3. Trigger image processing or thumbnail generation on the target system
  4. Overwrite stack memory to induce crash or achieve memory corruption

How to detect it

Monitor process logs and crash dumps for ImageMagick binaries encountering bzip2 images; inspect application error logs for segmentation faults or memory corruption signals during image decoding operations.

What your security team should do

  • Apply the listed version upgrades within 48 hours given the one-day publication window
  • Inventory all systems and containers using ImageMagick and prioritize those exposed to external image input
  • Implement input sanitization or format restrictions as a temporary control until patches are deployed

The record

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities