CVE-2026-55597

What it actually does

CVE-2026-55597 is a heap buffer overwrite in ImageMagick's JP2 encoder caused by incorrect handling of arguments before version 7.1.2-26. When ImageMagick is invoked to encode or manipulate JPEG 2000 / JP2 content with crafted parameters or input, memory beyond an allocated heap buffer can be overwritten. The published CVSS vector indicates local attack requirements and user interaction, with the primary confirmed impact being availability loss; the most realistic technical outcome is process crash or denial of service in applications, batch jobs, or services that call ImageMagick to process untrusted image content. There is no current indication from the provided data of public exploit maturity, KEV listing, ransomware use, confidentiality impact, or integrity impact.

Why it matters to the business

Organizations that use ImageMagick in content ingestion, document conversion, media processing, thumbnail generation, CI pipelines, or backend batch processing may experience service crashes or failed image-processing workflows if malicious or malformed JP2 content is processed. While the CVSS score is moderate and EPSS is very low, ImageMagick is commonly embedded in other software and automation, so operational exposure may exist indirectly through downstream applications. The main business risk is disruption of image-processing services rather than data theft or system takeover based on currently available information.

How an attack unfolds

An attacker first identifies a workflow that processes user-controlled image files or image-conversion requests using ImageMagick prior to version 7.1.2-26. The attacker then supplies a specially crafted JPEG 2000 / JP2 file or conversion request that causes the vulnerable JP2 encoder path to mishandle arguments. When ImageMagick processes the content, the encoder writes past the bounds of a heap buffer. In practical terms, this can terminate the ImageMagick process or the calling application, interrupting service availability. In server-side deployments where ImageMagick automatically processes uploads, exploitation may be triggered remotely through an upload or conversion feature even though the CVSS vector describes local execution and user interaction.

How to fix it

Upgrade ImageMagick to version 7.1.2-26 or later wherever it is installed directly or bundled into applications, containers, base images, serverless functions, desktop tools, and CI/CD jobs. If vendor packages lag behind upstream, apply the distribution-maintained security update that backports the fix. Rebuild and redeploy container images and application bundles that include ImageMagick. As interim mitigations, restrict or disable JP2/JPEG 2000 encoding where not required, avoid processing untrusted JP2 files, enforce file type allowlists, apply resource limits to ImageMagick processes, isolate image conversion in a sandboxed worker, and ensure ImageMagick policy configuration limits risky coders and resource consumption.

How to confirm the fix worked

Confirm the installed ImageMagick version reports 7.1.2-26 or later using `magick -version`, `convert -version`, package manager inventory, container image scans, or software composition analysis. Validate that all runtime images and downstream packages were rebuilt after the upgrade. Review ImageMagick policy configuration to confirm JP2/JPEG 2000 processing is disabled or constrained if not required. Test representative JP2 conversion workflows after patching to ensure normal functionality remains intact. For exposure validation, search application code, job definitions, containers, and package manifests for ImageMagick invocations and JP2/JPEG 2000 processing paths.

Typical attack path

1. Identify an application, service, script, or pipeline that uses ImageMagick for JPEG 2000 / JP2 processing.
2. Confirm or infer that the ImageMagick version is earlier than 7.1.2-26.
3. Create or obtain malformed JP2/JPEG 2000 content or processing arguments that trigger the vulnerable encoder behavior.
4. Submit the crafted content to a file upload, media conversion, thumbnailing, document-processing, or batch-processing workflow.
5. Wait for the backend ImageMagick process to encode or transform the content.
6. Cause a heap buffer overwrite that most likely results in a crash, failed job, or denial of service.

How to detect it

To determine whether exploitation may already have occurred, review application logs, upload logs, media-processing worker logs, job queue failures, system journals, crash reports, core dumps, and endpoint telemetry for ImageMagick crashes or abnormal failures during JP2/JPEG 2000 processing. Focus on periods where untrusted images were uploaded or converted and look for repeated processing failures involving `.jp2`, `.j2k`, `.jpf`, `.jpx`, or JPEG 2000 MIME types. Correlate failed conversions with source IPs, user accounts, uploaded filenames, request paths, and subsequent worker restarts. On Linux, inspect `journalctl`, syslog, kernel OOM/crash messages, coredump metadata, and service supervisor restart events for `magick` or `convert`. In containerized environments, review container stdout/stderr, orchestrator restart counts, exit codes, and crash loop events. AddressSanitizer, hardened allocator, or debug builds may log heap-buffer-overflow messages tied to JP2 encoder code. There are no known threat actors or public exploitation campaigns in the provided data, so detection should focus on behavioral evidence of malformed JP2 processing and ImageMagick instability rather than actor-specific indicators.

• magick
• convert
• identify
• .jp2
• .j2k
• .jpf
• .jpx
• image/jp2
• image/jpx
• image/jpm
• JPEG 2000
• JP2
• heap-buffer-overflow
• heap buffer overflow
• heap-buffer-overwrite
• buffer overflow
• coders/jp2
• JP2 encoder
• MagickCore
• MagickWand
• Segmentation fault
• SIGSEGV
• core dumped
• AddressSanitizer
• ImageMagick

What your security team should do

• Inventory all direct and bundled ImageMagick installations, including containers, media-processing services, developer workstations, automation jobs, and third-party applications.
• Prioritize upgrading internet-facing or user-content-processing workflows to ImageMagick 7.1.2-26 or later.
• If immediate upgrade is not possible, disable or restrict JP2/JPEG 2000 encoding and processing for untrusted content.
• Run software composition analysis and container scans to identify transitive ImageMagick exposure in packaged applications.
• Apply process isolation, memory/resource limits, and queue-based worker separation to reduce denial-of-service impact from malformed images.
• Monitor application and system logs for ImageMagick crashes, repeated failed JP2 conversions, and suspicious upload patterns involving JP2/JPEG 2000 files.
• Because this is not listed in KEV and has very low EPSS with no known exploit maturity, treat it as a routine but necessary patch rather than an emergency response unless JP2 processing is exposed to untrusted users.