CVE-2026-116149: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compressed Images

Q: Which ImageMagick versions need to be remediated?

ImageMagick versions before 6.9.13-58 are affected in the 6.x branch, and versions before 7.1.2-33 are affected in the 7.x branch. Upgrade to at least the applicable fixed version.

Q: What must an attacker provide to trigger the issue?

An attacker needs to supply a crafted image that uses bzip2 compression and have ImageMagick decode it. The listed vector indicates network-reachable exploitation is possible with low attack complexity, but the attacker requires low-level privileges.

Q: What is the likely impact if exploitation succeeds?

Decoding the crafted image can overwrite stack memory, resulting in a crash or memory corruption. The severity vector rates integrity and availability impact as high, while confidentiality impact is listed as none.

Published Oct 25, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption.

Affected Software

1 affected component

ImageMagick ImageMagick<6.9.13-58, >=7.0.0<7.1.2-33

Event History

Oct 25, 2026

CVE Published

via MITRE·01:19 PM

Data Sourced

via MITRE·01:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which ImageMagick versions need to be remediated?

ImageMagick versions before 6.9.13-58 are affected in the 6.x branch, and versions before 7.1.2-33 are affected in the 7.x branch. Upgrade to at least the applicable fixed version.

What must an attacker provide to trigger the issue?

An attacker needs to supply a crafted image that uses bzip2 compression and have ImageMagick decode it. The listed vector indicates network-reachable exploitation is possible with low attack complexity, but the attacker requires low-level privileges.

What is the likely impact if exploitation succeeds?

Decoding the crafted image can overwrite stack memory, resulting in a crash or memory corruption. The severity vector rates integrity and availability impact as high, while confidentiality impact is listed as none.

CVE-2026-116149: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compressed Images

Affected Software

Event History

Frequently Asked Questions

Which ImageMagick versions need to be remediated?

What must an attacker provide to trigger the issue?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which ImageMagick versions need to be remediated?

What must an attacker provide to trigger the issue?

What is the likely impact if exploitation succeeds?