CVE-2026-42050

ImageMagick: Stack buffer overflow in XTileImage

Published May 11, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-21 and 6.9.13-46, a malicious MIFF file could trigger an overflow when a user opens it in the display tool and right-clicks a tile to invoke the Load / Update menu item. This vulnerability is fixed in 7.1.2-21 and 6.9.13-46.

Analysis

Technical impact

A stack buffer overflow in the XTileImage component of ImageMagick can be triggered by opening a specially crafted MIFF file in the display tool and then right‑clicking a tile to invoke the Load / Update menu. The flaw is a stack buffer overflow (CWE‑121) that also involves uninitialized memory usage (CWE‑131). The overflow leads to a crash of the application. The vulnerability is scored at 5.5 on the CVSS scale, indicating a moderate impact.

Affected Systems

ImageMagick versions older than 7.1.2‑21 and 6.9.13‑46 are vulnerable. This includes all releases of the 7.x series before 7.1.2‑21 and all releases of the 6.x series before 6.9.13‑46. Users of the free and open‑source ImageMagick product who run the display utility are potentially affected.

Risk and Exploitability

The CVSS score of 5.5 reflects the local nature of this flaw: an attacker must deliver a malicious MIFF file and have the victim open it in the display tool, then perform a specific user action. No remote exploitation vector is documented, and the EPSS score, recorded as 0.00014 (<1%), indicates a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Immediate patching mitigates the risk entirely.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ImageMagick

affected

Version	Status	Constraints
`< 6.9.13-46`	affected	—
`>= 7.0.0, < 7.1.2-20`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:imagemagick:imagemagick::::::::
	cpe:2.3:a:imagemagick:imagemagick::::::::

No data.

Vendor Product Versions

Imagemagick

Version	Status	Scheme	Platform
`[0,6.9.13-46)`	affected	semver	—
`[7.0.0,7.1.2-20)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade ImageMagick to version 7.1.2‑21 or newer, or 6.9.13‑46 or newer, to remove the overflow.
Avoid opening unknown MIFF files with the ImageMagick display tool to eliminate the trigger.
If possible, disable or restrict the Load / Update menu in the XTileImage feature to prevent the vulnerable action from being available to untrusted users.

Generated by OpenCVE AI on May 19, 2026 at 01:51 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4609-1	imagemagick security update
Debian DSA	DSA-6298-1	imagemagick security update
Debian DSA	DSA-6310-1	imagemagick security update

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.130% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7mxf-ff4f-jj7p
https://nvd.nist.gov/vuln/detail/CVE-2026-42050
https://www.cve.org/CVERecord?id=CVE-2026-42050

History

May 19, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-131
References		https://nvd.nist.gov/vuln/detail/CVE-2026-42050 https://www.cve.org/CVERecord?id=CVE-2026-42050
Metrics	threat_severity `None`	threat_severity `Moderate`

May 13, 2026 7:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:imagemagick:imagemagick::::::::

May 12, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 11, 2026 10:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Imagemagick Imagemagick imagemagick
Vendors & Products		Imagemagick Imagemagick imagemagick

May 11, 2026 8:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-21 and 6.9.13-46, a malicious MIFF file could trigger an overflow when a user opens it in the display tool and right-clicks a tile to invoke the Load / Update menu item. This vulnerability is fixed in 7.1.2-21 and 6.9.13-46.
Title		ImageMagick: Stack buffer overflow in XTileImage
Weaknesses		CWE-121
References		https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7mxf-ff4f-jj7p
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}`