CVE-2026-46521: ImageMagick Buffer Overflow Vulnerability

CVE-2026-46521 Overview

CVE-2026-46521 is an out-of-bounds write vulnerability in ImageMagick, the open-source image editing and manipulation library. The flaw exists in the Magick Image File Format (MIFF) encoder when LZMA compression is used. A missing bounds check allows writes outside allocated buffers during image encoding operations. The issue is tracked under [CWE-131: Incorrect Calculation of Buffer Size]. ImageMagick maintainers patched the vulnerability in versions 6.9.13-48 and 7.1.2-23.

Critical Impact
Local attackers can trigger an out-of-bounds write that leads to process crash or potential memory corruption when ImageMagick encodes attacker-influenced images using MIFF with LZMA compression.

Affected Products

ImageMagick versions prior to 6.9.13-48 (6.x branch)
ImageMagick versions prior to 7.1.2-23 (7.x branch)
Applications and services that embed ImageMagick libraries for image processing

Discovery Timeline

2026-06-10 - CVE-2026-46521 published to the National Vulnerability Database (NVD)
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-46521

Vulnerability Analysis

The vulnerability resides in the MIFF encoder path within ImageMagick. When the encoder writes image data using LZMA compression, a required boundary check is missing before performing memory writes. As a result, the encoder can write past the end of the destination buffer.

The attack requires local access and user interaction, typically achieved by convincing a user or service to encode a crafted image into the MIFF format using LZMA compression. The impact is limited to availability, with confidentiality and integrity unaffected. Exploitation primarily results in application crashes, though out-of-bounds writes can enable further memory corruption depending on heap state.

Root Cause

The root cause is an incorrect calculation of buffer size [CWE-131] in the MIFF encoder's LZMA compression branch. The encoder allocates a destination buffer based on assumptions that do not account for the maximum compressed output size LZMA can produce. Without a guard checking the remaining buffer capacity before each write, the encoder advances beyond the allocated region.

Attack Vector

An attacker who controls input passed to ImageMagick can cause the application to invoke the MIFF encoder with LZMA compression. Workflows that automatically convert user-supplied images, such as document processing pipelines, content management systems, and image hosting services, expand the attack surface. The vulnerability manifests during the encode operation. Refer to the GitHub Security Advisory GHSA-jcqp-6r6f-3mfx for additional technical details.

Detection Methods for CVE-2026-46521

Indicators of Compromise

Repeated crashes or segmentation faults in processes loading libMagickCore or libMagickWand when handling MIFF output
Core dumps generated during image conversion jobs that target the MIFF format with LZMA compression
Unexpected termination of image processing workers shortly after receiving user-supplied images

Detection Strategies

Inventory all systems running ImageMagick and compare installed versions against the patched releases 6.9.13-48 and 7.1.2-23
Monitor application logs for ImageMagick errors referencing MIFF encoding or LZMA stream failures
Use file integrity monitoring on ImageMagick binaries and configuration files such as policy.xml

Monitoring Recommendations

Alert on abnormal crash rates for image conversion services and worker processes
Track invocations of the convert, magick, or mogrify utilities that produce .miff output
Capture process memory and exit codes for post-incident analysis when ImageMagick terminates unexpectedly

How to Mitigate CVE-2026-46521

Immediate Actions Required

Upgrade ImageMagick to version 6.9.13-48 or 7.1.2-23 or later across all affected systems
Audit application pipelines that invoke ImageMagick and confirm whether MIFF output with LZMA compression is in use
Restrict who can submit images to backend conversion services until patches are applied

Patch Information

The ImageMagick project released fixes in versions 6.9.13-48 and 7.1.2-23. Apply the vendor-supplied builds or rebuild from source using the patched tags. Distributions that package ImageMagick will publish corresponding security updates; verify package versions against the upstream patched releases. Full details are available in the ImageMagick GitHub Security Advisory.

Workarounds

Disable the MIFF coder in policy.xml if MIFF output is not required by your workflow
Avoid using LZMA compression when writing MIFF files until the patched version is deployed
Run ImageMagick processes under a low-privilege account with resource limits to contain crashes

bash

# Configuration example: disable the MIFF coder in ImageMagick policy.xml
# Add the following entry inside the <policymap> section
<policy domain="coder" rights="none" pattern="MIFF" />