CVE-2026-48724

What it actually does

This vulnerability is a memory corruption flaw in ImageMagick before version 7.1.2-24. When ImageMagick processes a specially crafted image that uses an image mask together with the Floyd-Steinberg dithering method, it can perform a negative heap buffer overwrite. The most likely technical result is process instability or a crash, causing denial of service in applications, scripts, or services that invoke ImageMagick to transform untrusted images. The published CVSS vector indicates local execution with user interaction required, no confidentiality or integrity impact, and high availability impact.

Why it matters to the business

Organizations that use ImageMagick in upload pipelines, media conversion services, document processing workflows, CI jobs, desktop image tools, or backend automation may experience failed image processing, worker crashes, job retries, queue backlogs, or service degradation if crafted images are processed. The EPSS score is currently very low and the issue is not listed in CISA KEV, so broad active exploitation is not indicated, but ImageMagick is widely embedded in downstream applications and container images, making patching important wherever untrusted images are accepted.

How an attack unfolds

An attacker prepares an image file that triggers the vulnerable mask-handling path while Floyd-Steinberg dithering is applied. The attacker then gets a victim user, application, upload service, batch processor, or automated pipeline to process that image with a vulnerable ImageMagick version. During image conversion or manipulation, ImageMagick calculates an invalid negative heap offset and overwrites memory outside the intended heap buffer. In practical terms, exploitation is expected to crash the ImageMagick process or the calling worker, producing denial of service for the processing task or service. There is no public indication from the supplied data that reliable code execution, data theft, ransomware use, or named threat actor exploitation is occurring.

How to fix it

Upgrade ImageMagick to version 7.1.2-24 or later wherever it is installed directly, bundled in an application, included in a container image, or provided by an operating system package. If immediate upgrade is not possible, reduce exposure by preventing ImageMagick from processing untrusted images, isolating image processing in a sandboxed worker or container, enforcing strict resource limits, disabling unnecessary coders/delegates through policy.xml, and validating or normalizing images before processing. Restart long-running services, workers, or containers after the patched package is installed so they load the fixed binaries and libraries.

How to confirm the fix worked

Confirm that all runtime environments use ImageMagick 7.1.2-24 or later by checking `magick -version`, `convert -version`, package-manager inventory, container image manifests, and application dependency bundles. Validate that web services, background workers, CI jobs, and desktop deployments do not continue using older vendored binaries. Where feasible, run a controlled regression test that exercises image masking and Floyd-Steinberg dithering against the patched build and verify the process completes without crashes. Also confirm that monitoring no longer shows recurring ImageMagick segmentation faults, aborts, heap corruption errors, or worker restarts during image processing.

Typical attack path

1. Identify an application, service, script, or desktop workflow that processes attacker-supplied images with ImageMagick before version 7.1.2-24.
2. Create or obtain a crafted image that includes a mask and triggers Floyd-Steinberg dithering in the vulnerable processing path.
3. Submit the image through an upload form, API, shared folder, email attachment, document-processing workflow, or other channel that causes ImageMagick to process it.
4. Wait for the vulnerable conversion, resize, thumbnailing, or manipulation operation to execute.
5. Cause the ImageMagick process or worker to crash, potentially leading to failed jobs, service errors, or processing backlog.

How to detect it

To determine whether this vulnerability may have been exploited, review logs from applications and services that invoke ImageMagick, especially upload handlers, thumbnail generators, media conversion workers, document processors, CMS platforms, email gateways, ticketing systems, and CI jobs. Look for crashes or abnormal exits of `magick`, `convert`, `mogrify`, or dependent worker processes shortly after processing image uploads or image-conversion requests. Relevant sources include application logs, web access logs, reverse proxy logs, job queue logs, container stdout/stderr, systemd journal, kernel logs, crash dumps, EDR process telemetry, and orchestrator restart events. Investigate events containing heap corruption, heap buffer overwrite, segmentation fault, abort, malloc/free corruption, AddressSanitizer findings, or repeated worker restarts associated with image filenames, uploads, or conversion commands. Correlate suspicious crashes with inbound file submissions from the same source IP, account, session, API token, or request path. Preserve submitted files and crash artifacts for offline analysis in a sandbox, but avoid reprocessing suspected malicious samples on production systems.

• magick
• convert
• mogrify
• ImageMagick
• FloydSteinberg
• Floyd-Steinberg
• heap-buffer-overflow
• heap buffer overflow
• heap-buffer-overwrite
• heap buffer overwrite
• negative heap
• Segmentation fault
• segfault at
• SIGSEGV
• SIGABRT
• malloc(): corrupted top size
• malloc(): invalid size
• free(): invalid pointer
• double free or corruption
• corrupted double-linked list
• AddressSanitizer
• ERROR: AddressSanitizer
• core dumped
• systemd-coredump
• Process magick dumped core
• Process convert dumped core
• /usr/bin/magick
• /usr/bin/convert
• /usr/bin/mogrify
• /usr/local/bin/magick
• /usr/local/bin/convert
• /var/lib/systemd/coredump
• /var/crash

What your security team should do

• Inventory all uses of ImageMagick, including OS packages, containers, serverless layers, CI/CD images, application bundles, and third-party products that embed it.
• Prioritize upgrades for internet-facing upload, thumbnailing, media conversion, document conversion, ticketing, CMS, collaboration, and email-processing systems that handle untrusted files.
• Upgrade to ImageMagick 7.1.2-24 or later and rebuild/redeploy dependent containers and application images.
• Apply defense-in-depth controls for image processing: sandboxing, non-privileged execution, seccomp/AppArmor/SELinux profiles, CPU and memory limits, file-size limits, and job timeouts.
• Restrict enabled ImageMagick coders and delegates to only those required by business workflows using policy.xml.
• Monitor for abnormal ImageMagick crashes, worker restarts, repeated failed conversion jobs, and spikes in image-processing errors.
• Because the vulnerability is not in KEV and has low EPSS, treat it as a normal-priority patch unless the affected deployment processes untrusted external images, in which case raise priority.