CVE-2026-46559: ImageMagick Buffer Overflow Vulnerability

CVE-2026-46559 Overview

CVE-2026-46559 is a heap buffer overflow vulnerability in ImageMagick, an open-source image editing and manipulation suite. The flaw resides in the JPEG 2000 (JP2) handling code, where an incorrect bounds check allows a single-byte write past the end of an allocated heap buffer. Triggering the issue requires processing an image with specific command-line options. The vulnerability affects ImageMagick versions prior to 6.9.13-48 and 7.1.2-23, and is classified under [CWE-193] Off-by-one Error.

Critical Impact
A local attacker who supplies crafted input to ImageMagick with specific options can corrupt heap memory by one byte, potentially causing process crashes or limited memory corruption affecting availability.

Affected Products

ImageMagick versions prior to 6.9.13-48
ImageMagick versions prior to 7.1.2-23
Applications and services that invoke ImageMagick for JP2 image processing

Discovery Timeline

2026-06-10 - CVE-2026-46559 published to the National Vulnerability Database (NVD)
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-46559

Vulnerability Analysis

The vulnerability is an off-by-one heap buffer over-write triggered during ImageMagick's processing of JPEG 2000 (JP2) images. An incorrect boundary check in the JP2 code path permits a single byte to be written one position past the end of a heap-allocated buffer. The defect requires that specific command-line options be supplied when processing the image, which constrains the conditions under which it is reachable.

The attack vector is local. An attacker must be able to invoke convert, magick, or another ImageMagick utility against attacker-influenced input with the relevant option set. Successful exploitation primarily impacts availability through process crashes, though single-byte heap corruption can in some cases be leveraged for further memory tampering depending on the surrounding heap layout.

Root Cause

The root cause is an incorrect length or boundary check in the JP2 decoder path. The check fails to account for one element in a write operation, producing a classic off-by-one condition consistent with [CWE-193]. The defective comparison allows the code to write past the allocated buffer boundary by exactly one byte.

Attack Vector

Exploitation requires local access and the ability to influence ImageMagick command-line arguments or supply a malicious JP2 image to a processing pipeline. Web applications that pass user-uploaded images through ImageMagick with fixed option sets that do not include the triggering flags are not directly exposed. The vulnerability does not require authentication or user interaction beyond invoking the vulnerable command path.

No verified public proof-of-concept exploit code is available at this time. For technical details, refer to the GitHub Security Advisory GHSA-533m-3wf6-c33v.

Detection Methods for CVE-2026-46559

Indicators of Compromise

Unexpected crashes or SIGABRT/SIGSEGV signals from ImageMagick processes (convert, magick, identify) when processing JP2 files
Heap corruption diagnostics from glibc such as malloc_consolidate(): invalid chunk size or free(): corrupted unsorted chunks originating from ImageMagick child processes
Anomalous JP2 files in image-upload directories paired with subsequent worker process restarts

Detection Strategies

Inventory installed ImageMagick versions across servers and developer workstations and flag any release below 6.9.13-48 or 7.1.2-23
Audit application code and shell scripts for ImageMagick invocations that accept user-controlled options when processing JP2 inputs
Run AddressSanitizer (ASan) or Valgrind against ImageMagick builds in test environments to surface the heap over-write during regression testing

Monitoring Recommendations

Alert on repeated abnormal terminations of ImageMagick worker processes in container or web-server logs
Monitor image processing queues for files with the .jp2 extension that fail decoding repeatedly from the same source
Track package inventory changes to confirm patched ImageMagick versions remain installed after deployments

How to Mitigate CVE-2026-46559

Immediate Actions Required

Upgrade ImageMagick to version 6.9.13-48 or 7.1.2-23 (or later) on all affected hosts
Restrict which command-line options are permitted when invoking ImageMagick from applications that process untrusted images
Run ImageMagick processes under a low-privilege account inside a sandbox such as seccomp, AppArmor, or a container with reduced capabilities

Patch Information

The ImageMagick maintainers fixed the off-by-one check in versions 6.9.13-48 and 7.1.2-23. Patch details and commit references are published in the GitHub Security Advisory GHSA-533m-3wf6-c33v. Apply vendor-supplied package updates from your Linux distribution where available.

Workarounds

Disable JP2 coder support in ImageMagick's policy.xml until patched binaries are deployed
Reject .jp2 and JPEG 2000 MIME-type uploads at the application layer
Avoid passing user-controlled option flags to ImageMagick command-line tools

bash

# Disable the JP2 coder in /etc/ImageMagick-7/policy.xml
# Add the following inside the <policymap> element:
<policy domain="coder" rights="none" pattern="JP2" />
<policy domain="coder" rights="none" pattern="JPEG2000" />

# Verify ImageMagick version after patching
magick -version | head -n 1