ImageMagick: Four Heap Corruption Vulnerabilities Disclosed Together on July 30, 2026
Key findings • Four ImageMagick vulnerabilities disclosed on July 30, 2026, primarily involve heap buffer overflows and over-reads. • CVE-2026-62343 and CVE-2026-62363 relate to morphology an…
Key findings
- Four ImageMagick vulnerabilities disclosed on July 30, 2026, primarily involve heap buffer overflows and over-reads.
- CVE-2026-62343 and CVE-2026-62363 relate to morphology and fx operations, respectively.
- CVE-2026-62946 affects 32-bit platforms processing large JNX files, causing integer overflow.
- CVE-2026-64685 stems from an incomplete end-of-file check in the BGR decoder.
- Patches are available in versions 6.9.13-52 and 7.1.2-27, with users urged to update.
On July 30, 2026, a batch of four vulnerabilities was disclosed for ImageMagick, a widely used open-source software suite for image manipulation. These vulnerabilities, all patched on the same day, primarily involve heap buffer overflows and over-reads, posing risks to users who process untrusted image files. The disclosures highlight potential weaknesses in how ImageMagick handles specific image formats and operations.
Several of the disclosed vulnerabilities stem from issues with image processing operations. CVE-2026-62343, affecting versions prior to 6.9.13-51 and 7.0.1-0 up to 7.1.2-26, involves an invalid kernel in morphology operations that can lead to a heap buffer overwrite. Similarly, CVE-2026-62363, present in versions before 7.1.2-27, can cause a heap buffer overwrite within the fx operation when processing a crafted argument.
Another vulnerability, CVE-2026-62946, specifically targets 32-bit platforms. Processing an extremely large JNX file in versions prior to 6.9.13-52 and 7.1.2-27 can trigger an integer overflow, resulting in a heap buffer overwrite. Additionally, CVE-2026-64685, found in versions before 7.1.2-27, arises from the BGR decoder not properly checking for end-of-file conditions, potentially leading to a heap buffer over-read when a crafted image is processed.
All four vulnerabilities were addressed in subsequent releases. Versions 6.9.13-52 and 7.1.2-27 are indicated as patched versions for some of these issues, with 7.1.2-27 specifically mentioned as fixing CVE-2026-62363 and CVE-2026-64685. Users are advised to update to the latest available versions to mitigate these risks.
The coordinated disclosure of these four vulnerabilities underscores the importance of keeping ImageMagick updated, especially for systems that handle images from untrusted sources. The consistent theme of heap-based memory corruption issues highlights a critical area for developers to focus on in future security audits and development cycles. Users should prioritize applying the available patches to protect their systems from potential exploitation.