CVE-2026-42050: ImageMagick Buffer Overflow Vulnerability

CVE-2026-42050 Overview

CVE-2026-42050 is a stack-based buffer overflow [CWE-121] in ImageMagick, the open-source image editing and manipulation suite. The vulnerability affects versions prior to 7.1.2-21 and 6.9.13-46. A malicious Magick Image File Format (MIFF) file can trigger an overflow when a user opens it in the display tool and right-clicks a tile to invoke the Load / Update menu item. Exploitation requires local access and user interaction, and impact is limited to availability. Maintainers fixed the issue in 7.1.2-21 and 6.9.13-46.

Critical Impact

A crafted MIFF file can crash the ImageMagick display tool through a stack overflow when a user interacts with the Load / Update menu, resulting in denial of service on the local workstation.

Affected Products

• ImageMagick versions prior to 7.1.2-21 (7.x branch)
• ImageMagick versions prior to 6.9.13-46 (6.x branch)
• The display interactive tool shipped with ImageMagick

Discovery Timeline

• 2026-05-11 - CVE-2026-42050 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42050

Vulnerability Analysis

The flaw resides in the interactive display utility distributed with ImageMagick. When a user opens a MIFF image and right-clicks a tile, the resulting context menu exposes a Load / Update action. Selecting that action processes attacker-controlled data from the MIFF file along a code path that does not enforce sufficient bounds on a stack buffer.

MIFF is ImageMagick's native container format and supports arbitrary metadata, geometry fields, and per-pixel descriptors. A crafted file can supply oversized or unexpected field values that the Load / Update handler copies onto the stack without adequate validation. The result is memory corruption on the stack frame of the handling routine.

The attack is local and requires the victim to open the file in display and perform the specific menu action. The vulnerability does not yield code execution in any confirmed public analysis. Impact is limited to availability, consistent with a crash of the running display process.

Root Cause

The root cause is a stack-based buffer overflow [CWE-121] in the MIFF tile reload code path invoked by the display Load / Update menu item. Field values parsed from the MIFF file are written to a fixed-size stack buffer without length checks.

Attack Vector

An attacker delivers a malicious MIFF file to a target — for example, through email, a shared directory, or a download. The victim opens the file with display, right-clicks a tile, and selects Load / Update. The handler then parses the crafted fields and overflows the stack buffer, terminating the process.

The vulnerability manifests inside the interactive display binary and is not reachable through the non-interactive convert, identify, or magick command-line workflows. See the GitHub Security Advisory GHSA-7mxf-ff4f-jj7p for upstream technical details.

Detection Methods for CVE-2026-42050

Indicators of Compromise

• Unexpected crashes of the display process shortly after opening a MIFF file, often visible in dmesg or journalctl as a segmentation fault.
• Core dumps produced by display with stack frames inside MIFF tile reload routines.
• MIFF files received from untrusted sources with abnormally long header or geometry fields.

Detection Strategies

• Inventory installed ImageMagick versions across endpoints and compare against the fixed releases 7.1.2-21 and 6.9.13-46.
• Hunt for process crashes of display in endpoint telemetry, correlating with recent MIFF file opens by the same user.
• Scan file shares and mail gateways for MIFF files (.miff extension or id=ImageMagick magic header) originating from external sources.

Monitoring Recommendations

• Enable core dump collection on Linux workstations that run ImageMagick interactively.
• Forward display process termination events and parent-child process telemetry to your SIEM for correlation with file-open activity.
• Alert on installations of outdated ImageMagick packages reintroduced by manual builds or third-party repositories.

How to Mitigate CVE-2026-42050

Immediate Actions Required

• Upgrade ImageMagick to 7.1.2-21 or 6.9.13-46 on every system where the package is installed.
• Until patched, instruct users not to open MIFF files from untrusted sources with the interactive display tool.
• Restrict execution of display on multi-user systems to administrators or trusted users only.

Patch Information

The ImageMagick maintainers fixed the stack overflow in versions 7.1.2-21 and 6.9.13-46. Refer to the GitHub Security Advisory GHSA-7mxf-ff4f-jj7p for the upstream commit and release notes. Linux distributions typically ship the fix through backported security updates — apply vendor patches through apt, dnf, or your package manager of choice.

Workarounds

• Avoid the display tool for previewing untrusted MIFF files; use non-interactive utilities such as identify or convert for inspection instead.
• Block or quarantine .miff files at email and web gateways when they originate from external senders.
• Apply least-privilege controls so that interactive image previewing occurs in dedicated, non-privileged accounts.

# Verify installed ImageMagick version on Debian/Ubuntu
dpkg -l | grep -i imagemagick

# Verify installed ImageMagick version on RHEL/Fedora
rpm -qa | grep -i ImageMagick

# Upgrade on Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade imagemagick

# Upgrade on RHEL/Fedora
sudo dnf upgrade ImageMagick

# Confirm fixed version (expect 7.1.2-21 or 6.9.13-46 or later)
magick -version