CVE-2026-62946: ImageMagick Buffer Overflow Vulnerability

CVE-2026-62946 Overview

CVE-2026-62946 is an integer overflow vulnerability [CWE-190] in ImageMagick, the widely used open-source image manipulation library. The flaw affects versions prior to 6.9.13-52 and 7.1.2-27 when processing JNX files on 32-bit platforms. An extremely large JNX file triggers an integer overflow that leads to a heap buffer over-write. Exploitation requires local access and high attack complexity, and the primary impact is availability loss on the affected process.

Critical Impact
Processing a crafted JNX file on a 32-bit ImageMagick build causes a heap buffer over-write, which can crash the process or corrupt memory during image conversion workflows.

Affected Products

ImageMagick versions prior to 6.9.13-52 (6.x branch) on 32-bit platforms
ImageMagick versions prior to 7.1.2-27 (7.x branch) on 32-bit platforms
Applications and services bundling vulnerable ImageMagick builds for JNX decoding

Discovery Timeline

2026-07-30 - CVE-2026-62946 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-62946

Vulnerability Analysis

The vulnerability lives in ImageMagick's JNX (Garmin JNX map tile) decoder. When the library computes buffer sizes for an extremely large JNX input, an arithmetic operation on 32-bit size_t values wraps around. The resulting undersized allocation is then written past its bounds during pixel or tile ingestion. The outcome is a heap buffer over-write in the ImageMagick worker process.

Exploitation requires the attacker to supply a crafted JNX file that ImageMagick then decodes. The issue is scoped to 32-bit builds because 64-bit size_t arithmetic does not wrap at the affected boundary. Impact is limited to availability, with no confidentiality or integrity effects reflected in the CVSS vector.

Root Cause

The root cause is an unchecked multiplication or addition on attacker-influenced dimensions in the JNX reader. On 32-bit builds the product exceeds UINT32_MAX and truncates, so the subsequent heap allocation is smaller than the data that will be written. Guidance on the exact code path is available in the GitHub Security Advisory.

Attack Vector

An attacker delivers a malicious JNX file to a system that invokes ImageMagick, for example through magick convert, identify, or a server-side thumbnailer that accepts uploaded images. Because the attack vector is Local and complexity is High, the attacker must either have local file placement or rely on an application that hands the JNX file to a vulnerable 32-bit ImageMagick binary. No authentication or user interaction is required from the ImageMagick process perspective.

No public proof-of-concept exploit code is currently available. Refer to the vendor advisory for technical details on the affected decoder logic.

Detection Methods for CVE-2026-62946

Indicators of Compromise

Unexpected crashes or segmentation faults in magick, convert, or identify processes when handling .jnx inputs
Presence of oversized or malformed JNX files in image upload, conversion, or batch-processing directories
Core dumps or ASan heap-buffer-overflow reports referencing the JNX coder in ImageMagick

Detection Strategies

Inventory installed ImageMagick versions across hosts and flag builds older than 6.9.13-52 or 7.1.2-27, prioritizing 32-bit systems
Alert on ImageMagick process crashes correlated with recent .jnx file reads via endpoint telemetry
Restrict or log the JNX coder in policy.xml and monitor policy denials as a signal of untrusted input processing

Monitoring Recommendations

Forward ImageMagick and web-application error logs to a centralized log platform for crash-pattern analysis
Track file uploads by MIME type and extension, flagging .jnx submissions to services that do not require them
Monitor 32-bit hosts that still run image-processing pipelines, as they present the primary exposure surface

How to Mitigate CVE-2026-62946

Immediate Actions Required

Upgrade ImageMagick to 6.9.13-52 or 7.1.2-27 or later on all systems, with priority on 32-bit builds
Disable the JNX coder in policy.xml where JNX decoding is not a business requirement
Reject .jnx uploads at the application or web-application-firewall layer if the workflow does not need them

Patch Information

The issue is fixed in ImageMagick 6.9.13-52 and 7.1.2-27. Downstream distributions typically publish backported packages; consult your distribution's security tracker and the upstream GitHub Security Advisory for confirmed fixed versions.

Workarounds

Migrate image-processing workloads from 32-bit to 64-bit ImageMagick builds where feasible
Add a coder policy in policy.xml that denies the JNX module until patched packages are deployed
Sandbox ImageMagick invocations with resource limits and seccomp profiles to contain heap corruption impact

bash

# Configuration example: disable the JNX coder in ImageMagick policy.xml
# Typical path: /etc/ImageMagick-7/policy.xml or /etc/ImageMagick-6/policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="JNX" />
</policymap>

# Verify installed version
magick -version | head -n 1