CVE-2026-46520: ImageMagick Buffer Overflow Vulnerability

CVE-2026-46520 Overview

CVE-2026-46520 is a heap-based out-of-bounds write vulnerability in ImageMagick, the open-source software suite for editing and manipulating digital images. The flaw occurs when ImageMagick reads multiple images with different dimensions, triggering a write past the bounds of an allocated heap buffer. The issue affects versions prior to 6.9.13-48 and 7.1.2-23, and was patched in those releases. The vulnerability is classified under [CWE-122] (Heap-based Buffer Overflow) and can be exploited remotely without authentication or user interaction by supplying a crafted image input.

Critical Impact
Remote attackers can trigger an out-of-bounds heap write, leading to process crashes, denial of service, and potential memory corruption when ImageMagick processes attacker-supplied images.

Affected Products

ImageMagick versions prior to 6.9.13-48
ImageMagick versions prior to 7.1.2-23
Applications and services embedding vulnerable ImageMagick libraries for image processing

Discovery Timeline

2026-06-10 - CVE-2026-46520 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-46520

Vulnerability Analysis

The vulnerability resides in ImageMagick's image-reading pipeline when it processes multiple input images that have differing dimensions. When the library iterates over a sequence of images, internal buffer sizing assumptions fail to account for dimension mismatches between frames. As a result, the code writes beyond the bounds of a heap-allocated buffer.

This class of memory corruption [CWE-122] commonly leads to denial of service through process termination. Depending on heap layout and the attacker's control over written data, heap overflows in image parsers have historically been leveraged to corrupt adjacent metadata structures. The attack vector is network-reachable in any service that accepts and converts user-supplied images, such as web upload pipelines, thumbnail generators, and document conversion workflows.

Root Cause

The root cause is improper validation of image geometry when assembling or iterating over a multi-image input. ImageMagick allocates buffers based on one set of dimensions but writes pixel or channel data using a different set, producing an out-of-bounds heap write. The patched versions 6.9.13-48 and 7.1.2-23 correct the boundary handling. Refer to the GitHub Security Advisory GHSA-36wm-hprc-mcf5 for technical details.

Attack Vector

An attacker delivers a crafted multi-frame image, such as a multi-page TIFF, GIF, or similar container, where individual frames have differing width and height values. When the vulnerable ImageMagick version reads the sequence, the dimension mismatch triggers the out-of-bounds write. No authentication or user interaction is required if the application processes uploaded images automatically.

No verified proof-of-concept code is publicly available. See the GitHub Security
Advisory GHSA-36wm-hprc-mcf5 for technical references and patch commits.

Detection Methods for CVE-2026-46520

Indicators of Compromise

Unexpected crashes or segmentation faults in convert, magick, or library consumers such as libMagickCore during image processing
Heap corruption signatures in core dumps generated by ImageMagick worker processes
Anomalous multi-frame image uploads with inconsistent per-frame dimensions appearing in application logs

Detection Strategies

Inventory hosts and containers running ImageMagick and compare installed versions against 6.9.13-48 and 7.1.2-23
Inspect package manifests, language bindings such as imagemagick Python or rmagick Ruby gems, and bundled binaries in container images
Enable AddressSanitizer (ASan) builds in pre-production to surface out-of-bounds writes during fuzzing of multi-frame image inputs

Monitoring Recommendations

Monitor image-processing worker processes for abnormal termination, restart loops, and elevated memory faults
Log all image upload attributes including frame count and per-frame dimensions for forensic review
Alert on repeated parsing failures from a single source, which may indicate exploitation attempts

How to Mitigate CVE-2026-46520

Immediate Actions Required

Upgrade ImageMagick to version 6.9.13-48 or 7.1.2-23 or later across all systems
Audit container images, virtual appliances, and third-party software that bundle ImageMagick libraries
Restrict image uploads to expected formats and reject multi-frame inputs where not required

Patch Information

The vulnerability is patched in ImageMagick 6.9.13-48 and 7.1.2-23. Apply the upstream release or the equivalent distribution security update. Patch details are published in the GitHub Security Advisory GHSA-36wm-hprc-mcf5.

Workarounds

Disable processing of multi-frame image formats in policy.xml until the patched version is deployed
Run ImageMagick in a sandboxed or containerized environment with strict resource limits and seccomp filters
Validate image dimensions and frame counts at the application layer before invoking ImageMagick

bash

# Example: restrict risky coders in /etc/ImageMagick-7/policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="GIF" />
  <policy domain="coder" rights="none" pattern="TIFF" />
  <policy domain="resource" name="memory" value="256MiB" />
  <policy domain="resource" name="width" value="8KP" />
  <policy domain="resource" name="height" value="8KP" />
</policymap>