CVE-2026-32259

What it actually does

This is a stack-based buffer overflow in ImageMagick's SIXEL encoder. In versions before ImageMagick 7.1.2-16 and 6.9.13-41, a memory allocation failure during SIXEL output generation can lead to a write past the end of a stack buffer. Successful exploitation could corrupt process memory, potentially allowing modification of output or program control flow, and can also crash the ImageMagick process. The CVSS vector indicates local attack conditions with high attack complexity, no required privileges, and high integrity and availability impact, but no expected confidentiality impact.

Why it matters to the business

Organizations using ImageMagick in image-processing workflows could experience failed image jobs, service crashes, or integrity issues in generated image output if an attacker can cause ImageMagick to process attacker-controlled content or conversion options. The current public exploitation signal is low: EPSS is approximately 0.001 and stable over 30 days, it is not listed in CISA KEV, and no mature public exploit is indicated. However, ImageMagick is commonly embedded in web applications, document pipelines, media services, and automation tooling, so exposure may be broader than direct package inventories suggest.

How an attack unfolds

An attacker first needs a path to make ImageMagick perform SIXEL encoding, either by invoking the local ImageMagick command-line tools directly or by submitting content to an application or automation workflow that converts images using ImageMagick. The attacker then attempts to influence memory pressure or allocation behavior so that the vulnerable allocation in the SIXEL encoder fails. Under the vulnerable condition, ImageMagick writes beyond the end of a stack buffer. In the most likely outcome, the process crashes, causing denial of service for the image-processing task or dependent service. With more precise control of the runtime environment, compiler protections, and stack layout, exploitation may allow integrity impact through memory corruption, though the high attack complexity and lack of known public exploit maturity reduce near-term likelihood.

How to fix it

Upgrade ImageMagick to a fixed release: 7.1.2-16 or later for the 7.x branch, or 6.9.13-41 or later for the 6.x branch. If using operating-system packages, install the vendor-provided security update and verify whether the vendor backported the fix while retaining an older upstream version string. Where immediate upgrade is not possible, reduce exposure by disabling SIXEL encoding if it is not required, for example through ImageMagick policy configuration, and by restricting untrusted users from controlling output formats or conversion arguments. Run ImageMagick in a sandboxed, least-privilege context with memory, CPU, file-size, and process limits to reduce the impact of crashes and memory-corruption attempts.

How to confirm the fix worked

Confirm the installed ImageMagick version with `magick -version`, `convert -version`, or the platform package manager, and verify it is at least 7.1.2-16 or 6.9.13-41, or that the vendor package changelog includes the backported fix for this vulnerability. Inventory applications and scripts that call `magick`, `convert`, `mogrify`, `identify`, or ImageMagick libraries and verify they use the patched binaries or libraries. If SIXEL is not required, confirm policy configuration prevents use of the SIXEL coder and test that attempts to write SIXEL output are denied. Validate operationally by running representative image-processing jobs after patching and confirming no crashes, allocation failures, or policy bypasses occur.

Typical attack path

1. Identify an application, service, job runner, or local workflow that uses ImageMagick for image conversion.
2. Determine whether the workflow permits or can be induced to produce SIXEL output, such as through output format selection, file extension handling, or conversion arguments.
3. Submit crafted image-processing input or invoke ImageMagick locally with SIXEL output enabled.
4. Attempt to trigger memory allocation failure during SIXEL encoding, for example by using large or resource-intensive conversion parameters under constrained memory conditions.
5. Cause the vulnerable stack out-of-bounds write in the ImageMagick process.
6. Crash the process or attempt to leverage memory corruption for integrity impact within the context of the ImageMagick process.

How to detect it

There are no public, vulnerability-specific indicators proving exploitation for this issue. To assess possible prior exploitation, review process execution logs, application logs, job-runner logs, container logs, system crash logs, and endpoint telemetry for ImageMagick activity involving SIXEL output followed by abnormal termination. Useful sources include Linux auditd or EDR process events for `magick`, `convert`, `mogrify`, and related tools; web or application logs showing user-submitted image conversion requests; system logs for `segfault`, `stack smashing detected`, `malloc`, allocation failure, or out-of-memory events; coredumpctl, ABRT, apport, or Windows Error Reporting artifacts; and container orchestrator restart events. Focus on crashes where command lines, file extensions, MIME types, or output paths reference SIXEL shortly before the failure. Preserve core dumps and input files associated with the crash for forensic analysis. Because exploitation requires specific memory-failure conditions and no known exploit maturity is reported, absence of these artifacts does not conclusively prove absence of attempted exploitation.

What your security team should do

• Prioritize patching internet-facing or multi-tenant services that process user-supplied images with ImageMagick, even though current exploitation probability is low.
• Upgrade to ImageMagick 7.1.2-16 or later, 6.9.13-41 or later, or an OS-vendor package that explicitly backports the fix.
• Inventory indirect ImageMagick usage in web frameworks, CMS plugins, document converters, media pipelines, CI jobs, and container images.
• Disable the SIXEL coder where it is not business-required, and prevent users from choosing arbitrary output formats or passing raw ImageMagick command options.
• Enforce sandboxing and resource limits for image-processing workloads to limit memory-pressure exploitation and contain crashes.
• Monitor for ImageMagick crashes, segmentation faults, stack-smashing messages, out-of-memory events, and unexpected SIXEL conversion activity.
• Because this is not KEV-listed, not associated with ransomware use, and has a low stable EPSS, handle as a normal-priority security update unless the environment exposes ImageMagick processing to untrusted users.