CVE-2026-62343: ImageMagick Buffer Overflow Vulnerability

CVE-2026-62343 Overview

CVE-2026-62343 is a heap buffer overflow vulnerability in ImageMagick, the widely deployed open-source image editing and manipulation library. The flaw affects versions prior to 6.9.13-51 and versions 7.0.1-0 and above prior to 7.1.2-26. An invalid user-supplied kernel triggers a heap buffer over-write when the application performs a morphology operation. Exploitation requires local access and user interaction, and the impact is limited to availability. The maintainers resolved the issue in versions 6.9.13-51 and 7.1.2-26. The vulnerability is tracked under CWE-190 (Integer Overflow or Wraparound).

Critical Impact
A crafted morphology kernel causes a heap buffer over-write in ImageMagick, leading to process crash or memory corruption when processing attacker-influenced input.

Affected Products

ImageMagick versions prior to 6.9.13-51
ImageMagick versions 7.0.1-0 through versions prior to 7.1.2-26
Applications and services embedding vulnerable ImageMagick releases for image processing

Discovery Timeline

2026-07-30 - CVE-2026-62343 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-62343

Vulnerability Analysis

ImageMagick's morphology feature applies mathematical transformations to images using a kernel supplied by the caller. When the library receives an invalid kernel definition, size validation fails to constrain subsequent memory operations. The result is a heap buffer over-write during the morphology pass. The advisory classifies the root cause under [CWE-190], indicating an integer overflow or wraparound influences the allocation or indexing math. Because morphology processes user-controlled kernels, any workflow that accepts kernel parameters from untrusted input inherits the risk. The vulnerability affects availability primarily, producing process termination or heap corruption when triggered.

Root Cause

The defect resides in the morphology code path that consumes a user-supplied kernel. Insufficient validation of kernel dimensions or element counts allows an arithmetic wraparound to produce an undersized allocation or an oversized write. The subsequent write exceeds the bounds of the heap buffer, corrupting adjacent chunks. See the GitHub Security Advisory for the maintainer analysis.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious kernel specification and induces a local user to run a morphology operation against it, using command-line tools such as magick or convert, or an application that passes user input to ImageMagick's morphology APIs. Successful exploitation produces heap corruption and denial of service against the processing host or service. No verified proof-of-concept code is publicly available at the time of publication.

Detection Methods for CVE-2026-62343

Indicators of Compromise

Crash logs, core dumps, or segmentation faults originating from magick, convert, or applications linking libMagickCore
Heap corruption signatures from AddressSanitizer or glibc malloc diagnostics tied to morphology calls
Unexpected termination of image-processing worker services after handling untrusted kernel parameters

Detection Strategies

Inventory hosts and containers running ImageMagick and compare installed versions against 6.9.13-51 and 7.1.2-26
Monitor process telemetry for abnormal termination of ImageMagick binaries following -morphology command-line arguments
Instrument staging environments with AddressSanitizer to surface heap over-writes during regression testing

Monitoring Recommendations

Alert on ImageMagick process crashes correlated with recently received user-uploaded content
Log invocations of ImageMagick command-line tools with -morphology, -kernel, or user-supplied kernel definitions
Track package inventory changes to confirm patched ImageMagick versions remain in place after deployments

How to Mitigate CVE-2026-62343

Immediate Actions Required

Upgrade ImageMagick to version 6.9.13-51 or 7.1.2-26 or later across all systems and container images
Audit applications that expose morphology operations or accept user-supplied kernels and restrict that surface until patched
Rebuild and redeploy container images that bundle ImageMagick to pick up the fixed library

Patch Information

The ImageMagick maintainers fixed the heap buffer over-write in versions 6.9.13-51 and 7.1.2-26. Details and commit references are documented in the GitHub Security Advisory GHSA-f5m7-cqgw-8hm7. Apply the vendor's distribution packages or build from the tagged upstream releases.

Workarounds

Disallow user-supplied kernel definitions in applications that call ImageMagick's morphology functionality
Configure policy.xml to restrict morphology or other high-risk coders where the feature is not required
Run ImageMagick under a least-privileged, sandboxed process to contain the impact of a heap corruption

bash

# Verify installed ImageMagick version meets the patched baseline
magick -version | head -n 1

# Example policy.xml restriction to disable morphology usage
# Place under /etc/ImageMagick-7/policy.xml or the distro equivalent
# <policy domain="filter" rights="none" pattern="Morphology" />