ImageMagick CVE-2026-116149

Exploitation requires that a vulnerable ImageMagick build (before 6.9.13-58, or 7.x before 7.1.2-33) decode an attacker-supplied image that uses bzip2 compression - the bzip2 decode path is the specific trigger named in the advisory. The attacker must be able to deliver such an image into an ImageMagick processing path (upload, conversion, or automated thumbnail/transform pipeline). Limiting factors: the target must actually process the malicious file with ImageMagick; whether the attacker needs authentication depends on the hosting application (the input assumes a low-privilege/authenticated context, PR:L), and the specific trigger beyond 'bzip2-compressed image' is not further detailed in the available sources. The flaw is fixed only by upgrading to 6.9.13-58 or 7.1.2-33; no alternative mitigation is stated by the vendor.

Signals are moderately but not critically aligned. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H) scores 7.2 and describes a remote, low-complexity write-based memory-corruption flaw with no confidentiality impact - consistent with the description of a stack buffer over-write causing crashes or memory corruption. The vuln.today priority is 'this_week' (not act_now or emergency), which argues for prompt but non-crash prioritization. No EPSS probability is provided, the CVE is NOT in CISA KEV, and no public exploit or PoC reference is present - only vendor/advisory links (VulnCheck and the ImageMagick GHSA). So exploitation status is 'no public exploit identified at time of analysis'; nothing in the input supports active exploitation. The main conflict is the privilege/attack-vector assumption: ImageMagick is a library with no inherent authentication, so whether exploitation is unauthenticated (PR:N) or requires a logged-in uploader (PR:L) depends entirely on the surrounding application - the input's PR:L reflects an assumed authenticated-upload deployment rather than an intrinsic property of the flaw; verify against your own deployment. The CWE classification is also inconsistent across sources (NVD CWE-121 stack overflow vs. GHSA CWE-125/CWE-573/CWE-787), which is a data-hygiene concern rather than a risk change. Net: a genuine, widely-relevant memory-corruption bug in extremely common software warranting timely patching, but currently without evidence of weaponization or widespread exploitation.

An attacker crafts an image that uses bzip2 compression and submits it to a service or workflow that decodes images with a vulnerable ImageMagick build (e.g., an avatar/thumbnail pipeline or file-conversion endpoint). During bzip2 decoding the oversized data overwrites adjacent stack memory, crashing the process or corrupting memory with potential for controlled behavior. No public exploit or PoC code is identified in the available sources; the attack vector is network-reachable with low complexity per the supplied CVSS.