CVE-2026-31853

What it actually does

This is a 32-bit integer overflow in ImageMagick's SFW image decoder. When a vulnerable 32-bit build of ImageMagick processes an extremely large SFW image, size calculations can overflow and cause unsafe memory behavior, most notably a process crash. The primary impact is availability loss for image-processing workflows; the CVSS vector also indicates limited integrity impact may be possible, but no public exploit maturity is reported and exploitation requires a specific vulnerable architecture/build and crafted input conditions.

Why it matters to the business

Organizations that use vulnerable ImageMagick versions in upload, thumbnailing, document conversion, media ingestion, or batch image-processing pipelines could experience service instability or outages if attacker-supplied images trigger crashes. Risk is lower for 64-bit deployments and currently appears low in the wild because the EPSS score is very low, has not increased over 30 days, is not in CISA KEV, and has no known public exploit maturity; however, ImageMagick is widely embedded in applications and automation, so vulnerable transitive or bundled copies may be overlooked.

How an attack unfolds

An attacker first needs a path to make a vulnerable 32-bit ImageMagick installation process attacker-controlled image content, such as a file upload feature, media conversion API, automated ingestion folder, email attachment processor, or local batch conversion job. The attacker supplies a specially crafted SFW image with extremely large image characteristics that trigger the vulnerable decoder path. When ImageMagick attempts to parse or convert the image, integer arithmetic overflows in the SFW decoder, causing memory corruption conditions that can crash the ImageMagick process. In service-backed deployments, repeated submissions can cause recurring worker crashes, failed image jobs, queue buildup, degraded application functionality, or denial of service.

How to fix it

Upgrade ImageMagick to a fixed release: ImageMagick 7.1.2-16 or later, or ImageMagick 6.9.13-41 or later. Prioritize systems that run 32-bit ImageMagick builds or process untrusted images. If immediate upgrade is not possible, reduce exposure by disabling SFW decoding through ImageMagick policy configuration, blocking or quarantining SFW uploads, enforcing strict file size and image dimension limits before ImageMagick processing, isolating conversion workers with resource limits, and ensuring worker crashes do not take down the parent application. Prefer 64-bit builds where operationally feasible, but do not treat architecture migration as a substitute for applying the vendor fix.

How to confirm the fix worked

Confirm the installed ImageMagick version with commands such as `magick -version`, `convert -version`, or package-manager inventory, and verify it is 7.1.2-16 or later for the 7.x branch or 6.9.13-41 or later for the 6.x branch. Confirm whether the build is 32-bit or 64-bit using OS package metadata or binary inspection. Check whether SFW support is enabled with `magick -list format` or `identify -list format` and review ImageMagick policy configuration if SFW decoding is intentionally disabled. Validate upload and conversion controls by confirming that oversized files, excessive image dimensions, and SFW files are rejected or safely quarantined before processing. In non-production testing, process representative benign SFW files and large-image boundary cases to confirm the service no longer crashes after patching or mitigation.

Typical attack path

1. Identify an application, service, or workflow that accepts image files and processes them with ImageMagick.
2. Determine or infer that the processing environment may be running a vulnerable 32-bit ImageMagick build prior to 7.1.2-16 or 6.9.13-41.
3. Create or obtain an SFW image with extremely large dimensions or size fields intended to exercise the vulnerable decoder path.
4. Submit the crafted image through an upload, conversion, ingestion, or batch-processing path.
5. Trigger ImageMagick to parse the file using the SFW decoder.
6. Cause the ImageMagick process or associated worker to crash, interrupting image processing or destabilizing the dependent service.
7. Repeat submissions if the goal is sustained denial of service or operational disruption.

How to detect it

There are no widely reported public exploitation campaigns for this issue, but defenders can look for attempted or successful triggering by correlating file-upload, media-ingestion, application, system, and EDR telemetry. Review web and API logs for SFW file uploads or image submissions immediately followed by ImageMagick worker failures, HTTP 5xx responses, queue retries, or conversion timeouts. Review process and system logs for crashes of `magick`, `convert`, `identify`, or application worker processes that invoke ImageMagick. On Linux, examine journald, syslog, kernel logs, coredump records, container logs, and supervisor logs for segmentation faults, aborts, out-of-memory events, or repeated restarts tied to SFW processing. Where file retention is available, inspect recently submitted image files for SFW format markers and unusually large declared dimensions or file sizes. In EDR, hunt for repeated short-lived ImageMagick processes spawned by web servers, queue workers, mail processors, or document-conversion services, especially when followed by crashes or core dumps.

• .sfw
• SFW
• magick -version
• convert -version
• identify -list format
• magick
• convert
• identify
• coders/sfw.c
• Segmentation fault
• segfault
• core dumped
• core-dump
• AddressSanitizer: heap-buffer-overflow
• AddressSanitizer: stack-buffer-overflow
• ImageMagick
• MagickCore
• MagickWand
• memory allocation failed
• cache resources exhausted

What your security team should do

• Inventory all direct, bundled, containerized, and transitive ImageMagick installations, including application images and media-processing workers.
• Upgrade vulnerable ImageMagick installations to 7.1.2-16 or later, or 6.9.13-41 or later, prioritizing 32-bit systems and internet-facing upload or conversion workflows.
• Temporarily disable SFW decoding or block SFW uploads where the format is not business-required.
• Enforce pre-processing controls for maximum file size, pixel dimensions, frame count, and resource consumption before files reach ImageMagick.
• Run ImageMagick conversion jobs in sandboxed, least-privilege worker contexts with CPU, memory, process, and timeout limits.
• Monitor for ImageMagick worker crashes, repeated failed conversions, and suspicious SFW uploads, especially from the same source over short time windows.
• Update base images, OS packages, language bindings, and vendor appliances that embed ImageMagick, not only standalone command-line installations.