CVE-2026-119123

What it actually does

Stack-based buffer overflow in the TIFF decoder path of ImageMagick when the DNG decoder is disabled, resulting in uncontrolled memory writes that terminate the process.

Why it matters to the business

Image-processing services or applications using the library become unavailable when a single malicious file is handled, leading to service outages and manual restarts with no data loss but repeated operational disruption.

How an attack unfolds

An attacker prepares a specially crafted TIFF image that targets the vulnerable decoder path, then causes the target application to load and process the file over the network or via file upload; the overflow occurs immediately on decode and crashes the process.

How to fix it

Upgrade ImageMagick to version 7.1.2-34 or later; rebuild any dependent applications against the patched library; disable TIFF processing entirely if the feature is not required.

How to confirm the fix worked

Confirm the installed version reports 7.1.2-34 or newer; attempt processing of a known-triggering TIFF sample in a test environment and verify the process no longer crashes.

Typical attack path

1. Locate services or scripts that invoke ImageMagick on user-supplied or externally obtained image files
2. Generate or obtain a TIFF file engineered to overflow the stack in the TIFF decoder when DNG support is absent
3. Deliver the file through any accepted input channel such as upload, URL fetch, or email attachment
4. Trigger ImageMagick processing of the file, causing immediate stack overflow and process termination

How to detect it

Review application and system logs for ImageMagick process terminations or segmentation faults immediately following TIFF file processing; correlate with web or upload server access logs showing recent TIFF deliveries.

• ImageMagick segmentation fault or stack overflow in syslog or application stderr
• Process exit code indicating abrupt termination during TIFFDecode
• Web server access logs containing .tif or .tiff uploads followed by 5xx responses or worker restarts

What your security team should do

• Apply the 7.1.2-34 update within the next maintenance window given the two-day publication window
• Inventory all hosts and containers that ship or link against ImageMagick and prioritize those accepting external images
• Add the patched version constraint to dependency manifests and CI build pipelines
• Monitor process crash logs and ImageMagick error output for TIFF-related stack faults until remediation is complete