CVE-2026-48734

What it actually does

ImageMagick versions before 6.9.13-49 and 7.1.2-24 can enter uncontrolled recursion or excessive stack growth while parsing a specially crafted MVG image because the parser lacks an adequate depth or visited-set check. Successful triggering causes a stack overflow and process crash, impacting availability of the ImageMagick command-line tool, library consumer, or any application component that invokes ImageMagick to inspect, transform, thumbnail, or convert user-supplied images. The vulnerability is categorized as denial of service; there is no indicated confidentiality or integrity impact, and no public exploit maturity or known exploitation is reported in the supplied data.

Why it matters to the business

Organizations that process untrusted image uploads or externally supplied files with vulnerable ImageMagick versions may experience crashes in image-processing jobs, thumbnail generation, media ingestion pipelines, document conversion workflows, or web application features that rely on ImageMagick. The likely consequence is service disruption, failed uploads, queue backlogs, increased resource consumption from repeated crashes or retries, and degraded customer-facing functionality. The EPSS score is very low and the issue is not listed in CISA KEV, so broad exploitation is not currently indicated, but internet-facing upload workflows should still be patched because malicious files can be submitted at low cost.

How an attack unfolds

An attacker prepares an MVG file that exercises the parser path missing recursion-depth or visited-node protections. The attacker then causes a vulnerable ImageMagick component to process the file, such as by uploading it to an application that generates previews, sending it through an automated media-processing queue, or convincing a user or batch process to run ImageMagick utilities such as convert, magick, or identify against the file. When the vulnerable parser processes the crafted MVG content, stack usage grows until the process terminates abnormally. In server-side deployments, repeated submissions can repeatedly crash worker processes or exhaust job-processing capacity, producing a denial-of-service condition for image handling features.

How to fix it

Upgrade ImageMagick to a patched release: 6.9.13-49 or later for the 6.x branch, or 7.1.2-24 or later for the 7.x branch. Ensure operating-system packages, container images, language bindings, and bundled vendor copies are updated, since applications often invoke ImageMagick indirectly. If immediate upgrade is not possible, reduce exposure by blocking or disabling MVG processing for untrusted input, enforcing strict allowlists of accepted image formats, validating file magic rather than trusting extensions, running ImageMagick in a sandboxed low-privilege worker, applying CPU/memory/time limits, disabling unnecessary coders via policy.xml, and rate-limiting upload or conversion requests. For high-risk upload services, consider isolating image processing into disposable containers or separate workers so crashes cannot affect the main application.

How to confirm the fix worked

Confirm the installed ImageMagick version reports 6.9.13-49 or later, or 7.1.2-24 or later, using package-manager inventory and the ImageMagick command-line version output. Verify that all runtime locations are covered, including containers, serverless layers, build images, application bundles, and third-party appliances that embed ImageMagick. Review ImageMagick policy.xml to confirm MVG and other unnecessary coders are disabled where business functionality does not require them. Test upload and conversion workflows with benign MVG files to confirm expected handling, and with controlled negative tests in a non-production environment to verify that malformed inputs are rejected or contained without crashing workers. Monitor after remediation for absence of ImageMagick crashes, abnormal worker exits, and repeated failed conversions from untrusted sources.

Typical attack path

1. Identify an application, service, or workflow that accepts image files and uses ImageMagick for conversion, metadata extraction, thumbnailing, or validation.
2. Create or obtain a malicious MVG file designed to trigger excessive recursive parsing and stack overflow in vulnerable ImageMagick versions.
3. Submit the MVG file directly or disguise it through filename, extension, content type, or upload workflow if the application relies on ImageMagick content detection.
4. Trigger server-side or local processing by causing ImageMagick to parse the file with magick, convert, identify, or a linked library wrapper.
5. Cause the ImageMagick process or dependent worker to crash, resulting in failed processing, service errors, retries, or queue backlog.
6. Repeat submissions to sustain disruption if rate limits, isolation, or crash recovery do not contain the impact.

How to detect it

To determine whether exploitation already occurred, review application upload logs, reverse-proxy logs, object-storage access logs, job-queue records, and media-processing worker logs for MVG files or files processed by ImageMagick immediately before crashes. Search system logs, container logs, crash reporters, core-dump directories, and EDR telemetry for abnormal exits of ImageMagick processes such as magick, convert, identify, or application workers that invoke ImageMagick. Correlate crashes with inbound uploads, conversion requests, or repeated failed jobs from the same source. Look for SIGSEGV, segmentation fault, stack overflow, core dumped, worker restart loops, exit code 139, or AddressSanitizer stack-overflow messages around ImageMagick processing. Because no unique public exploit string is provided, detection should focus on the combination of MVG handling, abnormal ImageMagick termination, and repeated submissions rather than a single definitive IOC.

• MVG
• mvg:
• Magick Vector Graphics
• magick
• convert
• identify
• Segmentation fault
• SIGSEGV
• stack overflow
• AddressSanitizer: stack-overflow
• core dumped
• exit code 139
• policy.xml
• coder="MVG"
• pattern="MVG"

What your security team should do

• Inventory ImageMagick deployments across hosts, containers, CI/CD images, application dependencies, and media-processing services.
• Prioritize patching systems that process untrusted uploads, email attachments, documents, or externally sourced media to ImageMagick 6.9.13-49+ or 7.1.2-24+.
• Disable MVG processing for untrusted input unless explicitly required, preferably through ImageMagick policy.xml coder restrictions and application-level file-type allowlists.
• Run ImageMagick in isolated, low-privilege, resource-limited workers with memory, stack, CPU, process, and execution-time controls.
• Add monitoring for ImageMagick process crashes, segmentation faults, stack-overflow messages, worker restarts, and spikes in failed image-conversion jobs.
• Hunt recent logs for suspicious MVG uploads or repeated conversion failures, especially from the same source address, account, or automation pattern.
• Ensure upload validation checks actual content and does not rely solely on file extensions or MIME types supplied by the client.
• Because the issue is not KEV-listed and has low EPSS, treat it as a normal-priority patch for internal-only processing but elevate urgency for internet-facing upload or conversion services.