Live › vulnerability › CVE-2026-116149
Go to dashboardImageMagick overflows a stack buffer while decoding bzip2-compressed images. A crafted image can crash the process or corrupt memory, and the sources do not say whether code execution is possible.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Any application that hands user-supplied images to ImageMagick and decodes them, including servers that generate thumbnails or convert uploads. Systems that never pass untrusted images to ImageMagick are much less exposed. The sources do not say which ImageMagick build options or delegates are required to reach the bzip2 path.
No product ranges from the sources yet.
magick -version and compare the version against 6.9.13-58 (6.x branch) and 7.1.2-33 (7.x branch).convert or magick on user-supplied files.6.9.13-58 or later.7.1.2-33 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption.
This page as .md · .json · in your agent: get_signal("CVE-2026-116149")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.