CVE-2026-28494: ImageMagick Buffer Overflow Vulnerability

CVE-2026-28494 Overview

A stack buffer overflow vulnerability exists in ImageMagick's morphology kernel parsing functions that allows attackers to cause stack corruption through specially crafted kernel strings. ImageMagick is widely-deployed open-source software used for editing and manipulating digital images across web applications, content management systems, and automated image processing pipelines.

The vulnerability occurs when user-controlled kernel strings exceeding expected lengths are copied into fixed-size stack buffers via memcpy without proper bounds checking. This results in stack corruption that can lead to integrity and availability impacts on affected systems.

Critical Impact

Successful exploitation of this stack buffer overflow can corrupt adjacent stack data, potentially enabling control flow hijacking or causing application crashes in image processing workflows.

Affected Products

• ImageMagick versions prior to 7.1.2-16
• ImageMagick versions prior to 6.9.13-41
• Applications and services using vulnerable ImageMagick libraries for image processing

Discovery Timeline

• 2026-03-10 - CVE-2026-28494 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-28494

Vulnerability Analysis

This vulnerability is classified as CWE-121 (Stack-based Buffer Overflow). The flaw resides in ImageMagick's morphology kernel parsing functionality, which processes user-supplied kernel definition strings used in image morphology operations such as erosion, dilation, and convolution filters.

When parsing these kernel strings, the affected code copies the input data into a fixed-size buffer allocated on the stack. The memcpy operation used for this copy does not validate that the source data fits within the destination buffer's boundaries. An attacker can craft a kernel string that exceeds the buffer size, causing the copy operation to overwrite adjacent stack memory including saved return addresses, frame pointers, and local variables.

The local attack vector requires user interaction—typically achieved by convincing a user or automated system to process a malicious image file or configuration containing the crafted kernel string. While the vulnerability does not directly impact confidentiality, it poses significant risks to system integrity and availability.

Root Cause

The root cause is insufficient bounds checking in the morphology kernel parsing code. The implementation allocates a fixed-size stack buffer to hold kernel definition strings but fails to validate the length of user-supplied input before performing the memory copy operation. This is a classic pattern that leads to stack buffer overflow vulnerabilities.

The absence of proper input length validation before the memcpy call allows attackers to write beyond the buffer boundary, corrupting the execution stack and potentially gaining control over program execution flow.

Attack Vector

The attack requires local access and user interaction, typically through processing a specially crafted image file or morphology kernel definition. Attack scenarios include:

1. Malicious Image Processing: An attacker supplies a crafted image file with embedded morphology operations to web applications or content management systems using ImageMagick
2. Direct API Exploitation: Applications that accept user-defined kernel strings for morphology operations can be targeted directly
3. Automated Pipeline Attacks: Image processing pipelines that handle untrusted input without proper sanitization are vulnerable

The vulnerability manifests in the morphology kernel parsing functions when processing oversized kernel definition strings. When the kernel string length exceeds the fixed stack buffer allocation, the unchecked memcpy operation writes past the buffer boundary, corrupting adjacent stack memory. This can overwrite critical stack data including return addresses and local variables. See the GitHub Security Advisory for complete technical details.

Detection Methods for CVE-2026-28494

Indicators of Compromise

• Unexpected ImageMagick process crashes or segmentation faults during image processing operations
• Application logs showing morphology kernel parsing errors or memory corruption indicators
• Abnormally large or malformed kernel definition strings in image files or processing requests
• Core dumps indicating stack corruption in ImageMagick library functions

Detection Strategies

• Monitor ImageMagick processes for unexpected termination signals (SIGSEGV, SIGABRT) that may indicate exploitation attempts
• Implement input validation to detect and reject oversized morphology kernel strings before they reach ImageMagick processing
• Deploy application-level logging to capture and analyze morphology operation parameters
• Use Address Sanitizer (ASan) in development and testing environments to detect buffer overflow conditions

Monitoring Recommendations

• Configure logging for all ImageMagick invocations including morphology operations and kernel definitions
• Implement alerting for unusual patterns in image processing failures or crashes
• Monitor system resource usage for signs of denial-of-service conditions resulting from exploitation attempts
• Review web application firewall logs for suspicious image upload patterns targeting ImageMagick endpoints

How to Mitigate CVE-2026-28494

Immediate Actions Required

• Upgrade ImageMagick to version 7.1.2-16 or later for the 7.x branch
• Upgrade ImageMagick to version 6.9.13-41 or later for the 6.x branch
• Review and restrict ImageMagick policy configurations to limit morphology operations if not required
• Implement input validation for any user-controlled data passed to ImageMagick morphology functions

Patch Information

ImageMagick has released security patches addressing this vulnerability. The fixes are included in versions 7.1.2-16 and 6.9.13-41. Organizations should update to these versions or later through their package manager or by downloading directly from the official ImageMagick repositories.

For detailed patch information and changes, refer to the GitHub Security Advisory GHSA-932h-jw47-73jm.

Workarounds

• Disable morphology operations through ImageMagick's policy.xml configuration if not required for your use case
• Implement strict input validation and length limits on any user-supplied kernel definition strings
• Use containerization or sandboxing to isolate ImageMagick processing from critical system components
• Consider using alternative image processing libraries for untrusted input until patching is complete

# Example policy.xml restriction to disable morphology operations
# Add to /etc/ImageMagick-7/policy.xml or equivalent
<policy domain="delegate" rights="none" pattern="morphology" />