CVE-2026-42050

What it actually does

CVE-2026-42050 is a local, user-interaction buffer overflow in ImageMagick's handling of MIFF image files through the graphical display tool. In affected versions before ImageMagick 7.1.2-21 and 6.9.13-46, a crafted MIFF file can trigger memory corruption when the file is opened and the user right-clicks a tile and selects the Load / Update menu item. The known impact is denial of service through a crash or forced termination of the ImageMagick display process. The CVSS vector indicates local attack requirements, low attack complexity, no privileges required, required user interaction, unchanged scope, no expected confidentiality or integrity impact, and high availability impact.

Why it matters to the business

Successful exploitation can interrupt image-viewing or image-processing workflows that rely on ImageMagick's graphical display component, causing application crashes, failed manual review tasks, and potential disruption to media, publishing, design, research, or operational teams that inspect MIFF files. Because exploitation requires a user to open a malicious file and perform a specific UI action, broad automated exploitation is less likely; EPSS is very low and flat over 30 days, it is not listed in CISA KEV, and there is no known exploit maturity. However, organizations that receive untrusted image files should still treat this as a targeted denial-of-service risk and upgrade during normal patch cycles or sooner where ImageMagick display is exposed to untrusted content.

How an attack unfolds

An attacker prepares a malformed MIFF image designed to trigger an overflow in vulnerable ImageMagick versions. The attacker then delivers the file through a channel likely to reach a user who opens image files, such as email, shared storage, file upload review queues, chat, ticket attachments, or removable media. Exploitation requires the victim to open the MIFF file using the ImageMagick display tool and then right-click a tile to invoke the Load / Update menu item. When that UI path processes the crafted file contents, the overflow corrupts process memory and can crash the display application, resulting in denial of service for that user session or workflow. Based on the available scoring and description, this should be treated as a crash/availability issue rather than a confirmed code-execution vulnerability.

How to fix it

Upgrade ImageMagick to a fixed release: 7.1.2-21 or later for the 7.x branch, or 6.9.13-46 or later for the 6.x branch. Where packages are supplied by an operating-system distribution, install the vendor security update that backports the fix and verify the package changelog references the issue or the fixed upstream version. If immediate upgrade is not possible, reduce exposure by preventing ImageMagick display from opening untrusted MIFF files, blocking or quarantining MIFF attachments from untrusted sources, converting untrusted images in isolated/sandboxed environments, disabling file associations that automatically launch ImageMagick display for MIFF content, and training users not to open unexpected MIFF files or invoke advanced image tile menu actions on untrusted content.

How to confirm the fix worked

Confirm the installed ImageMagick version reports 7.1.2-21 or later, or 6.9.13-46 or later, using commands such as `magick -version`, `convert -version`, or `display -version` depending on the installed branch and packaging. For distribution packages, verify the vendor package release includes the security backport even if the upstream version string is unchanged. Inventory systems for ImageMagick binaries and libraries, including container images, workstations, jump hosts, media-processing servers, and developer systems. Validate mitigations by confirming MIFF files from untrusted sources are blocked, quarantined, or opened only in isolated environments. Avoid using untrusted proof-of-concept files in production; if testing is required, perform it in a disposable sandbox and confirm the display tool no longer crashes when exercising the affected Load / Update UI path.

Typical attack path

1. Identify an organization or user likely to inspect MIFF image files with ImageMagick display.
2. Create or obtain a malformed MIFF file that triggers the vulnerable overflow path.
3. Deliver the malicious file through email, collaboration platforms, file shares, upload portals, or other file-exchange mechanisms.
4. Convince or wait for a user to open the file using the ImageMagick display tool.
5. Rely on the user to right-click a tile and select the Load / Update menu item.
6. Trigger the overflow and crash the ImageMagick display process, disrupting the user's image-handling workflow.

How to detect it

Look for evidence of ImageMagick display crashes shortly after MIFF files were opened or received. Relevant sources include endpoint detection telemetry, operating-system crash logs, application crash reporters, shell history, file-access auditing, email and web gateway attachment logs, EDR file-write events, helpdesk reports of image viewer crashes, and sandbox detonation results. On Linux and Unix-like systems, review syslog, journald, kernel logs, coredump records, auditd events, and desktop crash reports for `display` or `magick` crashes, segmentation faults, aborts, or core dumps involving `.miff` files. On macOS, review DiagnosticReports and unified logs for ImageMagick-related crashes. On Windows, review Windows Error Reporting, Application event logs, EDR telemetry, and user profile crash artifacts for ImageMagick executables. Correlate crash timestamps with newly downloaded or opened MIFF files, email attachments, shared-drive access, browser downloads, or file-transfer events. Preserve suspicious MIFF samples, hash them, and analyze only in an isolated sandbox. Since public exploit indicators are not known and exploitation requires a specific UI action, detection should focus on behavioral evidence: vulnerable ImageMagick versions, suspicious MIFF file ingress, and repeated display process crashes rather than fixed network signatures.

• .miff
• MIFF
• display
• magick display
• ImageMagick display
• Segmentation fault
• segfault at
• core dumped
• display crashed
• magick crashed
• ImageMagick crashed
• Load / Update
• AddressSanitizer: heap-buffer-overflow
• AddressSanitizer: stack-buffer-overflow
• ERROR: apport
• coredumpctl
• systemd-coredump
• Windows Error Reporting
• Application Error
• display.exe
• magick.exe

What your security team should do

• Patch ImageMagick to 7.1.2-21 or later, or 6.9.13-46 or later, prioritizing endpoints and workflows that handle externally supplied image files.
• Inventory all ImageMagick installations, including user workstations, media-processing systems, container images, CI runners, and bundled third-party applications.
• Restrict or quarantine MIFF files from untrusted sources until patching is complete, especially in email, file-sharing, upload, and ticketing workflows.
• Review file association policies so untrusted MIFF files are not automatically opened with the vulnerable ImageMagick display tool.
• Run ImageMagick-based review or conversion workflows in sandboxed or low-privilege environments when processing untrusted content.
• Monitor for crashes of `display`, `magick display`, or ImageMagick-related processes following the opening of MIFF files.
• Because EPSS is very low, flat, not KEV-listed, and no mature exploit is reported, handle as normal-to-expedited patching rather than emergency response unless local exposure to untrusted MIFF content is high.