CVE-2026-46521

What it actually does

This flaw is an out-of-bounds write in ImageMagick's MIFF encoder when LZMA compression is used. If a vulnerable ImageMagick 6.x version before 6.9.13-48 or 7.x version before 7.1.2-23 is made to encode image data as MIFF with LZMA compression, missing bounds validation can corrupt process memory. Based on the assigned severity, the expected impact is primarily process crash or denial of service rather than data theft or privilege escalation, although memory-corruption flaws should still be treated cautiously in services that process untrusted files.

Why it matters to the business

Systems, applications, or automated pipelines that use ImageMagick to process user-supplied images could be crashed by a malicious or malformed image-processing request, causing failed uploads, broken media workflows, degraded application availability, or worker queue disruption. The current public risk indicators are relatively low: EPSS is low, there is no known CISA KEV listing, no ransomware association, and no reported mature exploit, but ImageMagick is commonly embedded in web applications, CMS platforms, document conversion services, and CI/media pipelines, so exposure can be broad where image conversion is offered to untrusted users.

How an attack unfolds

An attacker first identifies an application, script, desktop workflow, or background worker that invokes ImageMagick on attacker-controlled input and can be influenced to produce MIFF output using LZMA compression. The attacker submits or causes processing of a crafted image or conversion job that reaches the vulnerable MIFF encoder path. During encoding, the missing bounds check allows data to be written outside the intended memory region. In the typical outcome, the ImageMagick process terminates unexpectedly, causing the image-processing request or worker to fail. In service contexts, repeated submissions can create a denial-of-service condition by crashing workers or exhausting restart capacity.

How to fix it

Upgrade ImageMagick to a patched release: ImageMagick 6.9.13-48 or later for the 6.x branch, or ImageMagick 7.1.2-23 or later for the 7.x branch. Where ImageMagick is bundled by an operating system, container image, language package, CMS plugin, appliance, or vendor product, apply the vendor-provided update rather than relying only on upstream version strings. Rebuild and redeploy containers or static images that include vulnerable ImageMagick binaries or libraries. If immediate upgrading is not possible, reduce exposure by preventing untrusted users from selecting MIFF output or LZMA compression, disabling MIFF processing where not required, isolating image conversion in a sandboxed worker with memory and CPU limits, and rate-limiting image conversion requests.

How to confirm the fix worked

Confirm the installed ImageMagick version with commands such as `magick -version`, `convert -version`, package-manager inventory, container SBOMs, or vendor software manifests. Validate that all ImageMagick 6.x installations are at 6.9.13-48 or later and all ImageMagick 7.x installations are at 7.1.2-23 or later. Check containers, build images, serverless layers, desktop packages, and application dependencies, not only host packages. Confirm that exposed image-processing paths do not allow untrusted users to request MIFF output with LZMA compression if mitigation is being used. After patching, run representative benign image-conversion jobs, including any legitimate MIFF/LZMA workflows, to confirm functionality remains stable and that older vulnerable binaries are no longer being invoked from PATH or embedded locations.

Typical attack path

1. Find an application, API, batch job, or user workflow that uses ImageMagick to convert or encode images.
2. Determine whether attacker-controlled files or conversion parameters can trigger MIFF output with LZMA compression.
3. Submit a crafted image or conversion request that reaches the vulnerable MIFF encoder path.
4. Trigger the out-of-bounds write during MIFF/LZMA encoding.
5. Cause the ImageMagick process or dependent worker to crash, disrupting image-processing functionality.

How to detect it

Look for evidence of crashes or repeated failures in services that invoke ImageMagick, especially around requests or jobs involving MIFF output or LZMA compression. Relevant sources include web and API access logs for upload or conversion endpoints, application worker logs, job queue failure records, container restart events, systemd or supervisor logs, kernel crash messages, core dump metadata, EDR process telemetry, and ImageMagick error logs where available. Hunt for repeated executions of `magick` or `convert` followed by abnormal termination, segmentation faults, allocator corruption messages, or worker restarts. Correlate failures with submitted filenames, MIME types, conversion parameters, and client IPs where permitted by logging policy. Because no public exploit-specific artifact is known, detection should focus on behavioral indicators: crafted image-processing attempts, MIFF/LZMA conversion requests from untrusted users, crash loops, and denial-of-service patterns against image-processing components.

• MIFF
• LZMA
• magick
• convert
• identify
• mogrify
• Segmentation fault
• segfault
• core dumped
• AddressSanitizer: heap-buffer-overflow
• AddressSanitizer: global-buffer-overflow
• heap-buffer-overflow
• out-of-bounds write
• corrupted size vs. prev_size
• double free or corruption
• malloc(): corrupted top size
• ImageMagick
• MagickCore
• MIFF encoder
• .miff

What your security team should do

• Inventory all direct and embedded ImageMagick usage across servers, containers, build pipelines, desktop tools, CMS components, and third-party applications.
• Prioritize upgrades for internet-facing or multi-tenant services that process untrusted image uploads or user-controlled conversion options.
• Upgrade to ImageMagick 6.9.13-48 or later, or 7.1.2-23 or later, and rebuild affected container images or packaged application artifacts.
• If patching is delayed, block or remove support for MIFF output and LZMA compression in user-controlled workflows, and run image conversion in a restricted sandbox with resource limits.
• Monitor image-processing services for abnormal crashes, repeated failed conversions, worker restarts, and requests involving MIFF/LZMA conversion options.
• Review application logic to ensure users cannot pass arbitrary ImageMagick command-line options or select unsafe output formats unless explicitly required.