UBUNTU-CVE-2026-116149: Buffer Overflow

Published Oct 25, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption.

Affected Software

8 affected components

ubuntu/imagemagick*

Event History

Oct 25, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attack vector is network-accessible, but the attacker needs low-level privileges. Exploitation does not require user interaction once a crafted bzip2-compressed image is supplied for decoding.

Which ImageMagick versions are affected?

ImageMagick versions before 6.9.13-58 and 7.x versions before 7.1.2-33 are affected.

What is the impact if exploitation succeeds?

A crafted bzip2-compressed image can overwrite stack memory while being decoded. This can cause crashes or memory corruption, with high integrity and availability impact.

UBUNTU-CVE-2026-116149: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which ImageMagick versions are affected?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which ImageMagick versions are affected?

What is the impact if exploitation succeeds?