CVE-2026-116149

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compressed Images

Published Oct 25, 2026 CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Description

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption.

Analysis

Technical impact

ImageMagick versions prior to 6.9.13‑58 and 7.x prior to 7.1.2‑33 contain a stack‑based buffer overflow in the handling of bzip2 compressed images. The flaw is identified as CWE‑121 and CWE‑787 and allows an attacker to supply a crafted image that, when decoded, writes beyond the intended stack buffer. This can corrupt memory or trigger a crash.

Affected Systems

All installations of ImageMagick running an earlier version than 6.9.13‑58 or 7.1.2‑33 are affected. The vulnerability impacts both the 6.x and 7.x branches of the software and applies to any system using the default image processing libraries.

Risk and Exploitability

The CVSS score of 7.2 signals a medium‑to‑high severity. EPSS is not available, so the precise likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is likely through any service or application that imports or processes images with the affected ImageMagick library; an adversary could deliver a malicious image to trigger the overflow.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ImageMagick

unaffected

Version	Status	Constraints
`7.0.0-0`	affected	< 7.1.2-33
`7.1.2-33`	unaffected	—

ImageMagick

unaffected

Version	Status	Constraints
`0`	affected	< 6.9.13-58
`6.9.13-58`	unaffected	—

Configuration 1 [-]

OR	cpe:2.3:a:imagemagick:imagemagick::::::::
	cpe:2.3:a:imagemagick:imagemagick::::::::

No data.

Vendor Product Versions

Imagemagick

Version	Status	Scheme	Platform
`[7.0.0-0,7.1.2-33)`	affected	semver	—
`7.1.2-33`	unaffected	semver	—

Imagemagick

Version	Status	Scheme	Platform
`[0,6.9.13-58)`	affected	generic	—
`6.9.13-58`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update ImageMagick to a patch level that includes the fix (6.9.13‑58 or later, or 7.1.2‑33 or later).
If an immediate upgrade is not possible, disable bzip2 image support in configuration or at the application level to prevent the vulnerable code path from executing.
Monitor application logs and system stability for segmentation faults or abnormal crashes during image decoding.

Generated by OpenCVE AI on October 26, 2026 at 01:52 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4875-1	imagemagick security update

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.356% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pwpf-8799-94cj
https://nvd.nist.gov/vuln/detail/CVE-2026-116149
https://www.cve.org/CVERecord?id=CVE-2026-116149
https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-stack-buffer-overflow-via-bzip2-compressed-images

History

Oct 29, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 26, 2026 12:30 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2026-116149 https://www.cve.org/CVERecord?id=CVE-2026-116149
Metrics	threat_severity `None`	threat_severity `Important`

Oct 25, 2026 1:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption.
Title		ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compressed Images
First Time appeared		Imagemagick Imagemagick imagemagick
Weaknesses		CWE-121
CPEs		cpe:2.3:a:imagemagick:imagemagick::::::::
Vendors & Products		Imagemagick Imagemagick imagemagick
References		https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pwpf-8799-94cj https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-stack-buffer-overflow-via-bzip2-compressed-images
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'}` cvssV4_0 `{'score': 7.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'}`