Advisory · CVE-2026-116149
Crafted bzip2-compressed image can overwrite stack memory in ImageMagick
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2-compressed images, so a crafted image can overwrite stack memory during decoding and crash the process or corrupt memory. CVSS 3.1 8.1.
- Vendor
- ImageMagick
- Product
- ImageMagick
- Identifier / CWE
- CVE-2026-116149
CWE-121 - Action timing
- Immediate
Explain it like I’m five
ImageMagick trusts the size of a squeezed image file while unpacking it onto a fixed-size scratch space, so a rigged file can spill past the edge of that space into memory it should never touch.
- 01Crafted image prepared
An attacker builds an image that uses bzip2 compression and is shaped to overflow the decoder.
- 02Image reaches a processor
The image is supplied to a service, upload pipeline, or tool that decodes it with ImageMagick.
- 03Bzip2 decoding overflows
While handling the compressed image, the decoder overwrites stack memory.
- 04Process crashes or corrupts
The decoding process crashes or its memory is corrupted, with integrity and availability impact rated high in the record.
What happened
ImageMagick disclosed CVE-2026-116149 in its GitHub security advisory, titled as a stack buffer over-write when reading bzip2-compressed images: a crafted image that uses bzip2 compression can cause a stack buffer over-write. The NVD record describes the same flaw as a stack-based buffer overflow in the handling of bzip2-compressed images and rates it CVSS 3.1 8.1, with high integrity and availability impact and no confidentiality impact.
The vendor advisory lists affected versions as before 7.1.2-33 and before 6.9.13-58, and patched versions as 7.1.2-33 and 6.9.13-58. Those are the only affected and fixed versions stated here, taken from the vendor advisory itself.
What to do
- Inventory where ImageMagick, its command-line tools, or bindings built on it decode images, especially upload, thumbnail, and document-conversion pipelines that accept files from untrusted sources.
- Upgrade affected installs to 7.1.2-33 or 6.9.13-58 or later, matching the branch you run, using the project release guidance.
- Until upgraded, decode untrusted images in a sandbox or low-privilege worker with strict resource limits, and avoid bzip2-compressed image inputs where you can reject them safely.
- Review decoder crash logs around the disclosure for repeated failures on bzip2-compressed inputs.
- Verify the deployed version after updating, including copies bundled inside containers and application images.
Management note
ImageMagick sits underneath a very large number of upload and conversion pipelines, often as an inherited dependency nobody owns. The fix is a version bump, but the real work is finding every place it decodes attacker-supplied files.