ImageMagick: 21 Vulnerabilities Including DoS and Policy Bypass Flaws Disclosed Together
Key findings • 21 vulnerabilities disclosed for ImageMagick on October 25, 2026, affecting versions before 6.9.13-58 and 7.1.2-33. • Majority of flaws are memory leaks and buffer overflows, l…
Key findings
- 21 vulnerabilities disclosed for ImageMagick on October 25, 2026, affecting versions before 6.9.13-58 and 7.1.2-33.
- Majority of flaws are memory leaks and buffer overflows, leading to denial-of-service conditions and potential memory corruption.
- Includes a high-severity stack-based buffer overflow (CVE-2026-116149) in bzip2 image handling.
- Several policy bypass vulnerabilities allow circumvention of security restrictions.
- Patched versions are 6.9.13-58 and 7.1.2-33; immediate update recommended.
On October 25, 2026, a significant batch of 21 vulnerabilities was disclosed for ImageMagick, a widely used open-source image manipulation software suite. These vulnerabilities, spanning various versions of ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33, primarily involve memory management issues such as memory leaks and buffer overflows, alongside several policy bypass flaws. The disclosures highlight potential risks including denial-of-service conditions and, in some cases, heap corruption that could lead to application crashes or more severe security implications.
A notable portion of these vulnerabilities are memory leaks, which can be triggered by processing specially crafted images. CVE-2026-116159, CVE-2026-116158, CVE-2026-116157, CVE-2026-116156, CVE-2026-116155, CVE-2026-116154, CVE-2026-116152, CVE-2026-116150, CVE-2026-116146, and CVE-2026-116151 all fall into this category. These leaks occur in various components and operations, including the -cdl option, magick compare command, PerlMagick, -set profile option, XMP profiles, XML parsing, MAT decoder, JNG encoder, MSL decoder, and FPX encoder. Repeatedly triggering these leaks can exhaust system memory, leading to denial-of-service conditions.
Beyond memory leaks, several vulnerabilities involve buffer overflows and related memory corruption issues. CVE-2026-116160 describes a heap-based buffer overflow in the X11 animate operation. CVE-2026-116149 details a high-severity (CVSSv3 8.1) stack-based buffer overflow in the handling of bzip2 compressed images, which could lead to crashes or memory corruption. Additionally, CVE-2026-116153 points to a heap buffer overflow on 32-bit systems related to convex-hull calculations, and CVE-2026-116142 describes a heap buffer over-read when printing a minimum-bounding-box. CVE-2026-116147 involves a null pointer dereference in the DJVU decoder, and CVE-2026-116144 details uncontrolled recursion in the MVG decoder leading to a stack overflow.
Several vulnerabilities relate to security policy bypasses, allowing attackers to circumvent configured restrictions. CVE-2026-116145 addresses an incomplete fix for a previous policy bypass, while CVE-2026-116143 describes a policy bypass in PS, PDF, and XPS decoders related to scene length limits. CVE-2026-116140 highlights a policy bypass in the UHDR decoder where extent checks are performed too late. Furthermore, CVE-2026-116140 indicates an issue with delegate invocations, potentially allowing blocked executables to run. CVE-2026-116148 involves an injection vulnerability in the MVG encoder, where user-specified options are not properly neutralized.
The disclosed vulnerabilities affect ImageMagick versions prior to 6.9.13-58 for the 6.x branch and prior to 7.1.2-33 for the 7.x branch. The fixes are available in ImageMagick versions 6.9.13-58 and 7.1.2-33, respectively. Users are strongly advised to update to these patched versions to mitigate the risks associated with these numerous memory management and policy bypass flaws.
This extensive batch of vulnerabilities underscores the importance of keeping ImageMagick updated, especially for systems that process untrusted image files. The prevalence of memory leaks and buffer overflows indicates a need for rigorous memory safety practices in image processing software. Users should prioritize updating their installations to the latest secure versions to prevent potential denial-of-service attacks and other security compromises. The fixes provided in versions 6.9.13-58 and 7.1.2-33 address a wide range of issues, making the upgrade a critical security measure.
The vulnerabilities disclosed on October 25, 2026, represent a broad set of issues within ImageMagick. The majority of these are low to medium severity, primarily leading to denial-of-service conditions through memory exhaustion or application crashes. However, the stack-based buffer overflow in CVE-2026-116149 carries a high severity rating, indicating a more significant risk of memory corruption. The policy bypass vulnerabilities also pose a threat by weakening security controls.
The fixes for these vulnerabilities are consolidated in ImageMagick versions 6.9.13-58 and 7.1.2-33. It is crucial for users to apply these updates promptly. The wide range of affected components and operations means that many different use cases could be exposed. Given ImageMagick's role in handling image data across various applications and web services, the impact of these vulnerabilities could be widespread if left unaddressed.
The batch includes several memory leak vulnerabilities, such as CVE-2026-116159, CVE-2026-116158, CVE-2026-116157, CVE-2026-116156, CVE-2026-116155, CVE-2026-116154, CVE-2026-116152, CVE-2026-116150, CVE-2026-116146, and CVE-2026-116151. These issues stem from improper memory cleanup in various decoding and encoding processes, as well as specific command operations.
Heap-based buffer overflows and over-reads are present in CVE-2026-116160, CVE-2026-116153, and CVE-2026-116142. These vulnerabilities can lead to memory corruption, potentially resulting in application crashes or exploitable conditions. CVE-2026-116149, a stack-based buffer overflow, is particularly concerning due to its high severity rating.
Policy bypass vulnerabilities, including CVE-2026-116145, CVE-2026-116143, and CVE-2026-116140, allow attackers to circumvent security restrictions configured within ImageMagick's policy files. This can enable the execution of unauthorized operations or the processing of excessive data. CVE-2026-116148 highlights an injection vulnerability in the MVG encoder.
Other vulnerabilities include a null pointer dereference in CVE-2026-116147 and uncontrolled recursion leading to a stack overflow in CVE-2026-116144. These issues primarily contribute to denial-of-service conditions.
The patched versions are 6.9.13-58 and 7.1.2-33. Users should update to these versions to address the disclosed vulnerabilities. The comprehensive nature of this batch emphasizes the need for diligent security practices when using ImageMagick.