CVE-2026-48994

What it actually does

This vulnerability is a heap buffer overwrite in ImageMagick's MAT image decoder on 32-bit systems. A missing return-value check can cause the decoder to continue processing after an allocation or parsing-related failure, allowing crafted MAT image input to write beyond the bounds of a heap buffer. The documented impact is availability: successful exploitation can crash the ImageMagick process or any application, service, worker, or pipeline that invokes ImageMagick to process untrusted MAT files. The CVSS vector indicates network-reachable exploitation is possible where ImageMagick is exposed through an upload, conversion, thumbnailing, or document-processing workflow, but exploitation has high complexity and no confirmed public exploit maturity is reported.

Why it matters to the business

Organizations that use ImageMagick for image upload handling, media conversion, thumbnail generation, document processing, or automated content pipelines could experience service crashes or job failures if malicious MAT files are processed on 32-bit builds. The most likely business outcome is denial of service affecting image-processing features, queues, or dependent applications rather than data theft. Because ImageMagick is widely embedded in downstream software and automation workflows, exposure may exist indirectly through third-party applications or packages that call ImageMagick. Current urgency is moderate: the CVSS score is medium, EPSS is low, the issue is not listed in CISA KEV, and no exploit maturity is reported; however, Internet-facing file upload and conversion services should still prioritize patching because unauthenticated attackers may be able to trigger processing remotely.

How an attack unfolds

An attacker identifies an application or service that accepts user-supplied files and processes them with ImageMagick on a vulnerable 32-bit build. The attacker crafts a malformed MAT file designed to trigger the missing return-value check in the MAT decoder and cause a heap buffer overwrite during parsing. The file is then submitted through an upload form, API endpoint, email/document ingestion workflow, batch conversion queue, or any path that invokes ImageMagick automatically. When the vulnerable decoder processes the file, memory corruption can occur and the ImageMagick process may crash, terminate a worker, or disrupt the surrounding service. There is no indication from the provided intelligence that this vulnerability is being used by named threat actors, ransomware campaigns, or public exploit kits.

How to fix it

Upgrade ImageMagick to a patched release: ImageMagick 6.9.13-48 or later for the 6.x branch, or ImageMagick 7.1.2-24 or later for the 7.x branch. Where ImageMagick is supplied by an operating-system distribution, container base image, language package, or bundled third-party product, apply the vendor-provided security update even if the displayed version uses distro-specific backporting. Prioritize systems that process untrusted files, especially Internet-facing upload, conversion, thumbnailing, and content-ingestion services. If immediate upgrade is not possible, reduce exposure by disabling MAT decoding where supported by policy configuration, blocking MAT files at upload boundaries, restricting accepted file types to known business-required formats, isolating image conversion workers, applying resource limits and crash supervision, and ensuring processing occurs in a sandboxed, least-privilege environment. Prefer 64-bit builds where possible, because the described overwrite condition is specific to 32-bit systems, but do not treat architecture migration as a substitute for patching.

How to confirm the fix worked

Confirm the installed ImageMagick version is 6.9.13-48 or later, 7.1.2-24 or later, or a vendor package that explicitly includes the fix for this issue. Validate both command-line tools and libraries used by applications, such as convert, magick, identify, and linked MagickCore/MagickWand components. Check container images, build artifacts, serverless layers, CI/CD images, desktop packages, and third-party applications that bundle ImageMagick. Verify whether deployed workloads are 32-bit; those are the systems directly affected by the described flaw. Review ImageMagick policy configuration to confirm MAT decoding is disabled if that mitigation is being used. Test representative upload and conversion workflows after patching to ensure legitimate image processing still works and malformed MAT input is rejected or handled without process crashes. Use package-manager advisory metadata or vendor changelogs rather than version strings alone when distributions backport security patches.

Typical attack path

1. Identify an application, API, or workflow that processes uploaded or externally supplied image files using ImageMagick.
2. Determine or assume that MAT file decoding is enabled and that the backend may run a vulnerable 32-bit ImageMagick build.
3. Create a malformed MAT file that exercises the vulnerable decoder path and triggers the unchecked return-value condition.
4. Submit the crafted MAT file through an upload, conversion, thumbnailing, ingestion, or batch-processing path.
5. Cause the ImageMagick process or dependent worker service to crash, resulting in denial of service or processing disruption.
6. Repeat submissions if needed to keep workers unavailable or degrade the reliability of the image-processing pipeline.

How to detect it

To determine whether exploitation may have occurred, review application, web server, API gateway, object-storage, mail-ingestion, and job-queue logs for externally supplied MAT files processed by ImageMagick, especially shortly before crashes or worker restarts. Correlate uploads or conversion requests with process crashes, segmentation faults, core dumps, container restarts, failed thumbnail jobs, or abnormal exit codes from ImageMagick tools. Examine system logs such as syslog, journald, kernel logs, container runtime events, supervisor logs, and crash-reporting systems for crashes of magick, convert, identify, or application-specific workers that link to ImageMagick. Look for repeated failed processing attempts from the same source IP, user agent, account, or API token, and for file names or content types indicating MATLAB MAT files. Because the provided intelligence does not include a public exploit signature, detection should focus on behavioral evidence: MAT file processing followed by memory corruption symptoms, denial-of-service patterns, and repeated worker crashes. If core dumps are available, preserve them and check whether the faulting process was ImageMagick or a process using MagickCore/MagickWand while decoding MAT input.

• .mat
• MAT
• image/x-mat
• application/x-matlab-data
• application/matlab-mat
• MATLAB
• magick
• convert
• identify
• MagickCore
• MagickWand
• Segmentation fault
• segfault
• heap buffer overflow
• heap-buffer-overflow
• AddressSanitizer
• ASAN
• core dumped
• ImageMagick
• coders/mat
• no decode delegate for this image format
• improper image header
• cache resources exhausted

What your security team should do

• Inventory all direct and bundled ImageMagick deployments, including containers, CI/CD workers, media-processing services, and third-party applications that invoke ImageMagick.
• Prioritize remediation for Internet-facing or externally reachable workflows that process untrusted files, especially on 32-bit systems.
• Upgrade to ImageMagick 6.9.13-48 or later, ImageMagick 7.1.2-24 or later, or the applicable vendor-backported fixed package.
• Temporarily block or disable MAT file processing if patching cannot be completed quickly.
• Add file-type allowlisting so only required image formats are accepted by upload and conversion services.
• Run image conversion in isolated, least-privilege workers with resource limits, restart controls, and separation from critical application services.
• Search logs for recent MAT file submissions and ImageMagick crashes since publication, especially for public upload or conversion endpoints.
• Update vulnerability management detections to account for distro backports and bundled ImageMagick copies, not just standalone package names.