CVE-2026-116160

What it actually does

Heap-based buffer overflow in the X11 animate operation that overwrites heap memory and can crash the application when a crafted image is processed.

Why it matters to the business

Image processing workflows using the animate feature under X11 can be disrupted by application crashes triggered by malicious images, potentially halting operations that depend on ImageMagick.

How an attack unfolds

An attacker creates a malicious image designed to trigger the buffer overflow during the X11 animate operation; the image is then supplied to a victim who executes the animate command, resulting in heap memory corruption and application termination.

How to fix it

Upgrade ImageMagick to version 6.9.13-58 or newer for the 6.x branch and to 7.1.2-33 or newer for the 7.x branch; avoid running untrusted images with the animate operation under X11 until patched.

How to confirm the fix worked

Verify installed ImageMagick version against the fixed releases; test the animate operation with known-malicious sample images in a controlled environment to confirm crashes are resolved.

Typical attack path

1. Craft a malicious image that exploits the heap buffer overflow in the animate code path
2. Deliver the image to a target user or system via email, web, or file share
3. Induce the user to run the X11 animate operation on the supplied image
4. Trigger heap memory overwrite leading to application crash

How to detect it

Review application and system logs for unexpected ImageMagick terminations during animate operations; inspect process crash dumps or core files that reference the animate code path.

What your security team should do

• Apply the listed version upgrades as soon as packages become available
• Restrict use of the X11 animate feature to trusted images only
• Monitor for ImageMagick crashes during image processing jobs
• Review downstream dependencies that ship ImageMagick and schedule updates