CVE-2026-42326: ImageMagick Buffer Overflow Vulnerability

CVE-2026-42326 Overview

CVE-2026-42326 is an out-of-bounds read vulnerability in ImageMagick, the open-source image editing and manipulation library. The flaw exists in the IPTC (International Press Telecommunications Council) output file writing routine. A malicious input file can trigger a single-byte out-of-bounds read when ImageMagick processes it and writes IPTC output. The vulnerability is classified under [CWE-125] (Out-of-bounds Read). The ImageMagick maintainers patched the issue in versions 6.9.13-47 and 7.1.2-22. Exploitation requires local access and user interaction with a crafted image, limiting widespread automated abuse.

Critical Impact
A crafted image file processed by ImageMagick can cause a one-byte out-of-bounds memory read during IPTC output, potentially disclosing adjacent memory contents or crashing the process.

Affected Products

ImageMagick 6.x versions prior to 6.9.13-47
ImageMagick 7.x versions prior to 7.1.2-22
Applications and services that embed vulnerable ImageMagick builds for image conversion

Discovery Timeline

2026-06-10 - CVE-2026-42326 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-42326

Vulnerability Analysis

The vulnerability resides in the IPTC profile writer within ImageMagick. When the library serializes IPTC metadata to an output file, the routine reads one byte beyond the bounds of an allocated buffer. The defect is triggered by attacker-controlled fields within the input image's metadata structures. Because the read is limited to a single byte, the practical impact centers on information disclosure of adjacent heap memory or a process crash if the read crosses an unmapped page boundary.

IPTC is a standard for embedding descriptive metadata (captions, keywords, copyright) in image files. ImageMagick supports IPTC profile read and write across many container formats, which broadens the attack surface to any workflow that re-encodes images.

Root Cause

The root cause is missing bounds validation on a length or index value derived from the input image's IPTC profile before that value is used to read from a buffer during output serialization. The IPTC writer trusts a size or offset field without verifying it against the actual profile length.

Attack Vector

An attacker crafts an image file containing a malformed IPTC profile and supplies it to a victim or a service that invokes ImageMagick. The attack vector is local, requiring the target to convert or re-encode the file. Server-side image processing pipelines that accept user uploads and call convert or the MagickWand API to emit IPTC-bearing outputs are realistic exposure paths. The vulnerability does not require authentication on the ImageMagick library itself, but exploitation depends on the host application's input handling.

No public proof-of-concept exploit code is available. See the GitHub Security Advisory GHSA-7wff-wpr6-vmhm for maintainer commentary.

Detection Methods for CVE-2026-42326

Indicators of Compromise

Unexpected ImageMagick process crashes (SIGSEGV) during IPTC profile serialization or image conversion jobs
Image conversion service logs showing repeated failures on files with malformed or oversized IPTC profile segments
AddressSanitizer or Valgrind reports flagging a one-byte heap-buffer-overflow read in IPTC writer code paths

Detection Strategies

Inventory ImageMagick installations across endpoints and servers and compare versions against 6.9.13-47 and 7.1.2-22
Inspect application logs for image processing services that surface ImageMagick errors or worker restarts tied to user-uploaded files
Run fuzz tests or replay sample IPTC-bearing files against staging instances with sanitizer builds to confirm patch status

Monitoring Recommendations

Monitor for crash signatures and core dumps generated by image processing workers
Track outbound conversion failures and quarantine input files that trigger ImageMagick faults for forensic review
Alert on anomalous file upload patterns containing oversized metadata segments to web applications using ImageMagick

How to Mitigate CVE-2026-42326

Immediate Actions Required

Upgrade ImageMagick to 6.9.13-47 or 7.1.2-22 or later across all systems
Rebuild or update downstream packages, container images, and language bindings (PHP Imagick, Wand, RMagick) that link against ImageMagick
Restrict image conversion services to least-privilege accounts and isolate them in sandboxed workers

Patch Information

The ImageMagick maintainers released fixes in versions 6.9.13-47 and 7.1.2-22. Patch details and references are published in the ImageMagick Security Advisory GHSA-7wff-wpr6-vmhm. Linux distributions typically backport the fix; verify your package manager reports the corrected upstream version.

Workarounds

Disable IPTC profile output by stripping metadata with -strip or +profile "*" in conversion commands until the patch is applied
Reject or sanitize uploaded images that contain IPTC profiles at the application boundary using a stricter image validator
Run ImageMagick under a resource-limited and seccomp-restricted process to contain crashes and limit information disclosure

bash

# Configuration example: strip metadata to avoid the vulnerable IPTC writer path
convert input.jpg -strip output.jpg

# Or remove all profiles explicitly
convert input.jpg +profile "*" output.jpg

# Verify installed ImageMagick version
magick -version | head -n 1