CVE-2026-48994: ImageMagick Buffer Overflow Vulnerability

CVE-2026-48994 Overview

CVE-2026-48994 is a heap buffer overflow vulnerability [CWE-122] in ImageMagick, the widely used open-source image processing library. The flaw affects the MAT (MATLAB) image format decoder on 32-bit systems. A missing return-value check allows an attacker-supplied MAT file to trigger a heap buffer over-write during decoding.

ImageMagick maintainers patched the issue in versions 6.9.13-48 and 7.1.2-24. Exploitation requires processing a crafted image, which is common in web services, content pipelines, and document conversion workflows that pass user-supplied files to ImageMagick.

Critical Impact

A crafted MAT file processed by a vulnerable 32-bit ImageMagick build can corrupt heap memory and crash the application, with potential for further memory corruption consequences.

Affected Products

• ImageMagick versions prior to 6.9.13-48 (6.x branch) on 32-bit systems
• ImageMagick versions prior to 7.1.2-24 (7.x branch) on 32-bit systems
• Applications and services that link ImageMagick libraries (libMagickCore, libMagickWand) on 32-bit architectures

Discovery Timeline

• 2026-06-10 - CVE-2026-48994 published to the National Vulnerability Database
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-48994

Vulnerability Analysis

The vulnerability resides in the MAT decoder within ImageMagick, which parses MATLAB v4/v5 image container files. The decoder calls a function that returns a status or pointer indicating success or failure. The calling code does not check this return value before continuing to operate on the resulting buffer.

When the underlying operation fails or returns an unexpected size on 32-bit builds, subsequent write operations exceed the allocated heap region. The 32-bit constraint matters because integer width and pointer arithmetic differ from 64-bit builds, which alters how size calculations wrap or truncate during allocation sizing.

The outcome is an out-of-bounds write on the heap, classified under [CWE-122] Heap-based Buffer Overflow. Per the CVSS vector, the primary observed impact is availability loss through process crash, with attack complexity rated high due to environmental conditions required for exploitation.

Root Cause

The root cause is a missing validation of a function return value inside the MAT image decoder. Without checking the return code, the decoder treats an uninitialized or undersized buffer as valid and writes decoded image data past the end of the heap allocation.

Attack Vector

The attack vector is network-reachable through any application that feeds untrusted MAT files into ImageMagick. Examples include image upload endpoints, thumbnailing services, document converters, and CI/CD pipelines that process user-supplied artifacts. The attacker delivers a crafted .mat file and relies on the server using a vulnerable 32-bit build of ImageMagick.

No verified public exploit code is available. Technical details are documented in the ImageMagick GitHub Security Advisory GHSA-4v89-6mgq-6rgc.

Detection Methods for CVE-2026-48994

Indicators of Compromise

• Unexpected crashes or segmentation faults in processes invoking convert, magick, or identify against .mat files
• Core dumps or heap corruption signatures from libMagickCore on 32-bit hosts
• Upload of MAT format files (.mat) to services that normally do not require MATLAB data

Detection Strategies

• Inventory all systems with ImageMagick installed and identify 32-bit builds using magick -version or identify -version
• Scan dependency manifests and container images for ImageMagick versions earlier than 6.9.13-48 or 7.1.2-24
• Enable verbose logging in image-processing services to capture decoder errors and abnormal terminations

Monitoring Recommendations

• Alert on repeated worker process crashes in image-processing pipelines, especially when correlated with .mat file uploads
• Monitor file upload endpoints for MAT magic bytes (MATLAB 5.0 MAT-file header) where MATLAB data is not expected
• Track ImageMagick policy file (policy.xml) integrity to ensure restrictive coder policies remain in place

How to Mitigate CVE-2026-48994

Immediate Actions Required

• Upgrade ImageMagick to version 6.9.13-48 or 7.1.2-24 (or later) on all 32-bit systems
• Where upgrade is not immediately feasible, disable the MAT coder in policy.xml to block decoding of MAT files
• Audit upstream applications and Docker images for bundled ImageMagick libraries and rebuild against patched versions

Patch Information

The ImageMagick project released fixes in 6.9.13-48 and 7.1.2-24. The patch adds the missing return-value check in the MAT decoder so that the function aborts cleanly when the underlying operation fails. See the ImageMagick GitHub Security Advisory GHSA-4v89-6mgq-6rgc for commit references and release notes.

Workarounds

• Add a policy.xml rule denying the MAT coder: <policy domain="coder" rights="none" pattern="MAT" />
• Migrate image processing workloads to 64-bit builds, which are not affected by this specific 32-bit code path
• Validate uploaded file types and reject MAT files at the application layer when not required by business logic

# Configuration example: disable the MAT coder in ImageMagick policy.xml
# Typical path: /etc/ImageMagick-7/policy.xml or /etc/ImageMagick-6/policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="MAT" />
</policymap>

# Verify policy is active
magick -list policy | grep -i mat