ImageMagick has a stack write buffer overflow in MNG encoder

Root

Cause

The vulnerability is a stack buffer overflow in the MNG encoder of ImageMagick, a widely used open-source image processing suite. Prior to versions 7.1.2-16 and 6.9.13-41, the encoder does not perform sufficient bounds checking when writing data, allowing an attacker to corrupt the stack with controlled data [1][2].

Exploitation

An attacker exploits this by providing a specially crafted MNG file to ImageMagick's processing pipeline. The vulnerability can be triggered without requiring any special privileges beyond the ability to submit an image for processing, and the attack complexity is considered low because the missing bounds check can be directly leveraged (as indicated by the advisory's attack vector and complexity metrics) [4].

Impact

Successful exploitation allows the attacker to overwrite stack memory with their own data, which can lead to arbitrary code execution in the context of the running process. This can compromise the confidentiality, integrity, and availability of the affected system, depending on how ImageMagick is used in the target environment [2][4].

Mitigation

The vulnerability has been fixed in ImageMagick versions 7.1.2-16 (released March 8, 2026) and 6.9.13-41 [2][3]. Users are strongly advised to update to these versions or later. Workarounds include applying a restrictive security policy, as recommended by the ImageMagick project, to limit the types of images that can be processed [1].