CVE-2026-32636

What it actually does

CVE-2026-32636 is a memory corruption flaw in ImageMagick's NewXMLTree method. In affected ImageMagick 7.x versions before 7.1.2-17 and 6.x versions before 6.9.13-42, processing crafted XML-related image metadata or image content can trigger an out-of-bounds write of a single null byte. The documented impact is a process crash, resulting in a denial-of-service condition for applications, services, or pipelines that invoke ImageMagick to parse untrusted images. There is no known confidentiality or integrity impact based on the published details, and no public exploit maturity is currently reported.

Why it matters to the business

Organizations that use ImageMagick in web upload flows, media processing queues, document conversion services, thumbnail generation, email attachment handling, or automated content pipelines may experience service crashes when processing maliciously crafted files. The likely business impact is interrupted image processing, failed jobs, degraded availability, and possible queue backlogs. The CVSS score is moderate, EPSS is low and flat over 30 days, and it is not listed in CISA KEV or known ransomware exploitation, so urgency is lower than actively exploited vulnerabilities; however, internet-facing or high-volume file-processing services should still prioritize remediation because exploitation requires no authentication or user interaction when attackers can submit files for processing.

How an attack unfolds

An attacker identifies an application or service that accepts files and processes them with a vulnerable ImageMagick version. The attacker crafts an image or file containing XML-related structures or metadata that cause ImageMagick's NewXMLTree method to perform a one-byte null write outside the intended memory boundary. The attacker submits the file through an upload endpoint, API, email attachment, document conversion workflow, or any other path that passes untrusted content to ImageMagick. When the vulnerable conversion or inspection operation runs, the ImageMagick process crashes. Repeated submissions can cause recurring job failures, worker restarts, service instability, or denial of service in dependent applications.

How to fix it

Upgrade ImageMagick to a fixed release: 7.1.2-17 or later for the 7.x branch, or 6.9.13-42 or later for the 6.x branch. If ImageMagick is provided by an operating system or container distribution, apply the vendor's security update for the imagemagick package rather than relying only on upstream version strings, because distributions may backport fixes. Rebuild and redeploy containers, serverless images, application bundles, and language-specific wrappers that include ImageMagick binaries or libraries. If immediate upgrade is not possible, reduce exposure by rejecting untrusted XML-like image formats where feasible, enforcing strict upload allowlists, limiting file size and parsing complexity, sandboxing ImageMagick execution, running workers with least privilege, applying CPU/memory/time limits, and isolating media-processing queues from critical application services.

How to confirm the fix worked

Confirm installed ImageMagick versions with commands such as `magick -version`, `convert -version`, `identify -version`, or package-manager queries, and verify they report 7.1.2-17 or later, 6.9.13-42 or later, or a vendor-backported fixed build. Validate that all runtime locations are covered, including containers, CI images, worker nodes, application dependencies, and embedded binaries used by wrappers. Review software composition analysis and container scan results for vulnerable imagemagick packages. After upgrading, run representative image-processing workflows and confirm that malformed test files are rejected or handled without worker crashes. For exposure validation, inventory services that accept untrusted files and invoke ImageMagick directly or through libraries, and ensure compensating controls such as sandboxing and resource limits are active.

Typical attack path

1. Identify an externally reachable feature that accepts images or files for conversion, thumbnailing, inspection, or metadata extraction.
2. Confirm or infer that the backend uses ImageMagick, for example through error messages, output behavior, supported formats, or exposed package information.
3. Create a malformed image or XML-bearing file designed to exercise the vulnerable NewXMLTree parsing path.
4. Submit the crafted file through an upload endpoint, API, message queue, email attachment, or document-processing workflow.
5. Trigger ImageMagick processing of the file using commands such as convert, magick, identify, mogrify, or library bindings.
6. Cause the vulnerable process to crash, resulting in failed conversions or service degradation.
7. Repeat submissions to maintain a denial-of-service condition or disrupt processing pipelines.

How to detect it

Look for evidence of repeated ImageMagick process crashes or failed conversions after processing attacker-supplied files. Relevant log sources include application upload logs, API gateway and web server access logs, media-processing worker logs, container stdout/stderr, systemd or supervisor logs, crash dumps, kernel logs, endpoint detection telemetry, and queue/job failure records. Search for segmentation faults, aborts, core dumps, worker restarts, failed identify/convert/magick executions, and bursts of malformed image uploads. Correlate crashes with the immediately preceding uploaded file name, source IP, user agent, account, job ID, and processing command. Because no public exploit indicators or threat actors are reported, detection should focus on behavioral signs: unauthenticated or anonymous uploads followed by ImageMagick crashes, repeated attempts from the same source, unusual XML/SVG/MVG/MSL-style content in image-processing paths, and denial-of-service patterns in conversion workers.

• segfault.*magick
• segfault.*convert
• segfault.*identify
• segfault.*mogrify
• ImageMagick.*segmentation fault
• ImageMagick.*core dumped
• magick.*core dumped
• convert.*core dumped
• identify.*core dumped
• mogrify.*core dumped
• MagickCore
• NewXMLTree
• convert:.*no decode delegate
• identify:.*no decode delegate
• magick:.*cache resources exhausted
• systemd-coredump.*magick
• systemd-coredump.*convert
• kernel:.*magick.*segfault
• kernel:.*convert.*segfault

What your security team should do

• Inventory all applications, containers, build images, and processing workers that include or invoke ImageMagick.
• Prioritize remediation for internet-facing upload services, public APIs, multi-tenant media-processing systems, and automated attachment/document conversion pipelines.
• Upgrade to ImageMagick 7.1.2-17 or later, 6.9.13-42 or later, or the relevant vendor-backported fixed package.
• Rebuild and redeploy container images and application bundles after package updates; do not assume host patching fixes statically bundled or containerized ImageMagick.
• Add or verify sandboxing, file type allowlisting, maximum file size limits, timeout limits, and worker restart controls for ImageMagick processing.
• Monitor for repeated ImageMagick crashes, abnormal conversion failures, and spikes in malformed file submissions, especially from the same source IP or account.
• Because EPSS is low, exploit maturity is none, and the issue is not in KEV, schedule remediation through standard vulnerability management unless exposed high-volume file-processing services materially raise operational risk.