DEBIAN-CVE-2026-116149: Buffer Overflow

Q: Which ImageMagick versions are affected?

ImageMagick versions before 6.9.13-58 and 7.x versions before 7.1.2-33 are affected.

Q: What does an attacker need to exploit this issue?

An attacker needs to supply a crafted image that uses bzip2 compression and have it decoded by a vulnerable ImageMagick installation. The vulnerability is reachable over the network and requires low privileges, with no user interaction indicated by the supplied severity vector.

Q: What is the likely impact if exploitation succeeds?

Decoding the crafted image can overwrite stack memory, causing a crash or memory corruption. The supplied severity vector identifies high impacts to integrity and availability.

Published Oct 25, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption.

Affected Software

3 affected componentsFixes available

debian/imagemagick*

debian/imagemagick<8:7.1.2.33+dfsg1-1

8:7.1.2.33+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:7.1.2.33+dfsg1-1

Event History

Oct 25, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which ImageMagick versions are affected?

ImageMagick versions before 6.9.13-58 and 7.x versions before 7.1.2-33 are affected.

What does an attacker need to exploit this issue?

An attacker needs to supply a crafted image that uses bzip2 compression and have it decoded by a vulnerable ImageMagick installation. The vulnerability is reachable over the network and requires low privileges, with no user interaction indicated by the supplied severity vector.

What is the likely impact if exploitation succeeds?

Decoding the crafted image can overwrite stack memory, causing a crash or memory corruption. The supplied severity vector identifies high impacts to integrity and availability.

DEBIAN-CVE-2026-116149: Buffer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Which ImageMagick versions are affected?

What does an attacker need to exploit this issue?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which ImageMagick versions are affected?

What does an attacker need to exploit this issue?

What is the likely impact if exploitation succeeds?