{"id":"CVE-2026-116149","kind":"vulnerability","aliases":["CVE-2026-116149"],"related":[],"title":"ImageMagick: stack overflow in bzip2 image decoding corrupts memory","description":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption.","summary":"ImageMagick overflows a stack buffer while decoding bzip2-compressed images. A crafted image can crash the process or corrupt memory, and the sources do not say whether code execution is possible.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["image-processing","imagemagick","package","self-hosted"],"not_affected_if":["no-untrusted-images"],"how_to_check":"- Run `magick -version` and compare the version against `6.9.13-58` (6.x branch) and `7.1.2-33` (7.x branch).\n- Check whether the service processes untrusted uploads with ImageMagick, for example with `convert` or `magick` on user-supplied files.","fix":"- Upgrade ImageMagick 6.x to `6.9.13-58` or later.\n- Upgrade ImageMagick 7.x to `7.1.2-33` or later.\n- Until patched, restrict or disable bzip2-compressed input from untrusted sources (unknown exact workaround).","status":"open","published_at":"2026-10-25T14:16:53+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","triaged_at":"2026-10-25T14:42:31+00:00","updated_at":"2026-10-25T14:42:31+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T14:42:31Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ImageMagick 6.x to `6.9.13-58` or later.\n- Upgrade ImageMagick 7.x to `7.1.2-33` or later.\n- Until patched, restrict or disable bzip2-compressed input from untrusted sources (unknown exact workaround).","reach":"unknown","title":"ImageMagick: stack overflow in bzip2 image decoding corrupts memory","impact":"high","summary":"ImageMagick overflows a stack buffer while decoding bzip2-compressed images. A crafted image can crash the process or corrupt memory, and the sources do not say whether code execution is possible.","category":"package","nicknames":[],"who_cares":["imagemagick","self-hosted","image-processing"],"confidence":0.5,"needs_auth":"unknown","worst_case":"crafted image crashes process or corrupts memory on the server","analyst_note":"Confirm the affected version ranges, whether the bzip2 path is reachable by default, and whether the overflow is exploitable for code execution, using the NVD entry and the upstream ImageMagick advisory.","how_to_check":"- Run `magick -version` and compare the version against `6.9.13-58` (6.x branch) and `7.1.2-33` (7.x branch).\n- Check whether the service processes untrusted uploads with ImageMagick, for example with `convert` or `magick` on user-supplied files.","needs_analyst":true,"not_affected_if":["no-untrusted-images"],"who_is_affected":"Any application that hands user-supplied images to ImageMagick and decodes them, including servers that generate thumbnails or convert uploads. Systems that never pass untrusted images to ImageMagick are much less exposed. The sources do not say which ImageMagick build options or delegates are required to reach the bzip2 path.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000663,"input_tokens":3338,"output_tokens":658,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116149':12A,15A '-2026':11A,14A '-33':65C '-58':59C '6.9.13':58C '7':61C '7.1.2':64C 'attack':80C 'base':70C 'buffer':28B,71C 'bzip2':5A,32B,77C,87C 'bzip2-compressed':31B 'caus':95C 'code':52B 'compress':33B,78C,88C 'contain':66C 'corrupt':8A,43B,99C 'craft':36B,84C 'crash':39B,96C 'cve':10A,13A 'decod':7A,30B,94C 'execut':53B 'handl':75C 'host':23B 'imag':6A,17B,34B,37B,79C,85C 'image-process':16B 'imagemagick':1A,19B,24B,56C 'memori':9A,44B,92C,98C 'overflow':3A,25B,72C 'overwrit':90C 'packag':20B 'possibl':55B 'process':18B,41B 'say':50B 'self':22B 'self-host':21B 'sourc':47B 'stack':2A,27B,69C,91C 'stack-bas':68C 'suppli':82C 'use':86C 'whether':51B 'x':62C","nicknames":[],"mitigations":[],"who_affected":"Any application that hands user-supplied images to ImageMagick and decodes them, including servers that generate thumbnails or convert uploads. Systems that never pass untrusted images to ImageMagick are much less exposed. The sources do not say which ImageMagick build options or delegates are required to reach the bzip2 path.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116149","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116149","severity":null,"published_at":"2026-10-25T14:16:53+00:00","modified_at":"2026-10-25T14:16:53+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","fetched_at":"2026-10-25T14:41:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}