CVE-2026-62343

What it actually does

ImageMagick can write past the end of a heap buffer when a morphology operation is executed with a malformed user-supplied kernel. The most likely practical impact is process instability or denial of service in the ImageMagick command-line tools or libraries used by applications. The published CVSS vector indicates exploitation requires local execution or an application workflow that causes ImageMagick to process attacker-controlled morphology parameters, plus user or application interaction; confidentiality and integrity impact are not currently established.

Why it matters to the business

Systems that rely on ImageMagick for image transformation, thumbnailing, document conversion, or media processing can experience crashes or failed processing jobs if exposed to malicious or malformed morphology inputs. This may disrupt upload pipelines, background workers, publishing workflows, or services that process user-supplied media. Current urgency is moderate: the CVSS score is 4.7, EPSS is low at 0.00124, it is not listed in CISA KEV, ransomware use is not reported, and no exploit maturity is reported; however, ImageMagick is widely embedded in downstream applications, so exposure may be broader than direct package inventories suggest.

How an attack unfolds

An attacker first needs a path to influence ImageMagick processing, such as access to a local command invocation, a script that accepts user-controlled ImageMagick arguments, or an application feature that applies morphology operations with externally supplied kernel values. The attacker provides an invalid or malformed morphology kernel. When ImageMagick parses and applies that kernel, the vulnerable code path performs an out-of-bounds heap write. In typical scenarios this causes the ImageMagick process or the calling worker process to crash, interrupting image-processing availability. There is no public indication from the provided data that reliable code execution, data theft, KEV exploitation, or ransomware use has been observed.

How to fix it

Upgrade ImageMagick to a fixed release: 6.9.13-51 or later for the 6.x branch, or 7.1.2-26 or later for the 7.x branch. Where ImageMagick is supplied by an operating-system distribution, apply the vendor security update even if the package version is backported and does not exactly match upstream numbering. Rebuild or redeploy applications and containers that bundle ImageMagick or link against ImageMagick libraries. As compensating controls, avoid accepting user-controlled morphology kernels, whitelist allowed ImageMagick operations and arguments, validate kernel syntax and size before use, run ImageMagick in a sandboxed low-privilege context, enforce memory/CPU/time limits through ImageMagick policy configuration and service supervisors, and isolate image-processing workers from critical application components.

How to confirm the fix worked

Confirm installed versions with commands such as `magick -version`, `convert -version`, `identify -version`, package-manager queries, container image inventories, and SBOM scans. Verify that all runtime locations use ImageMagick 6.9.13-51 or later, 7.1.2-26 or later, or a distribution package that explicitly includes the vendor fix for this vulnerability. Validate container base images and statically bundled application dependencies, not only host packages. Perform a controlled regression test in a non-production environment using invalid morphology kernel inputs and confirm the process rejects the input or fails safely without crashing. Review application configuration to ensure untrusted users cannot directly control ImageMagick morphology kernels or arbitrary command-line arguments.

Typical attack path

1. Identify an application, script, or processing workflow that uses ImageMagick morphology operations.
2. Find a way to control the morphology kernel value or the ImageMagick command/API parameters used by that workflow.
3. Submit a malformed kernel through the exposed input path or local invocation.
4. Trigger ImageMagick to execute the morphology operation.
5. Cause a heap buffer overwrite, usually resulting in a crash or failed image-processing job.
6. Repeat the trigger to create a denial-of-service condition against image-processing workers or dependent application features.

How to detect it

To assess prior exploitation, review application, worker, job-queue, and system logs for crashes or repeated failures in ImageMagick processes such as `magick`, `convert`, `mogrify`, or applications linked to MagickCore/MagickWand. Focus on events where morphology operations or kernel parameters were processed shortly before a crash, especially from user-upload, media-conversion, or batch-processing paths. Examine core dumps, crash reports, supervisor restart logs, container termination events, kernel logs, and EDR telemetry for segmentation faults, heap corruption, aborts, or abnormal exits involving ImageMagick. Correlate failures with incoming requests, uploaded files, job payloads, command-line arguments, and source IPs where available. Because no specific public exploit string or threat actor behavior is provided, detection should emphasize behavioral evidence: repeated malformed morphology requests followed by ImageMagick crashes or worker restarts.

• -morphology
• morphology
• magick
• convert
• mogrify
• identify
• MagickCore
• MagickWand
• Segmentation fault
• segfault
• heap-buffer-overflow
• heap corruption
• core dumped
• AddressSanitizer
• morphology.c

What your security team should do

• Inventory all direct and embedded ImageMagick installations across servers, containers, build images, CI pipelines, desktop tooling, and application dependencies.
• Prioritize patching systems that process untrusted user uploads or expose image-conversion features through web applications, APIs, background workers, or multi-tenant services.
• Upgrade to ImageMagick 6.9.13-51 or later, 7.1.2-26 or later, or the appropriate vendor-backported fixed package.
• Restrict or remove user control over ImageMagick command-line arguments, especially morphology operation and kernel parameters.
• Run ImageMagick under least privilege with resource limits, sandboxing, and worker isolation to reduce the impact of parser or memory-corruption flaws.
• Search recent logs and crash artifacts for ImageMagick segmentation faults or abnormal worker restarts involving morphology operations.
• Add regression tests and secure wrapper logic so unsupported ImageMagick operations or malformed kernels are rejected before invocation.