Skip to main content

ImageMagick CVE-2026-23876

CRITICAL
Heap-based Buffer Overflow (CWE-122)
2026-01-20 security-advisories@github.com
Buffer Overflow Heap Overflow Imagemagick
9.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify image upload/processing endpoint
  2. Delivery
    Submit crafted XBM file
  3. Exploit
    ReadXBMImage overflows heap buffer
  4. Execution
    Corrupt adjacent heap memory
  5. Impact
    Crash service or execute code

Vulnerability Assessment

Weakness
CWE
CWE-122
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that the target application pass attacker-supplied image data to ImageMagick for any read or identify operation (thumbnailing, conversion, metadata extraction) and that the XBM coder be enabled (the default). No authentication or user interaction is needed per the CVSS vector (PR:N/UI:N). The crafted file must be an XBM payload, but because ImageMagick auto-detects format by content, a misleading file extension does not prevent reaching the decoder. Limiting factors: the flaw is only reachable where an image-processing path consumes untrusted input, deployments that have disabled the XBM coder via policy.xml are not exposed, and reliable code execution (versus a crash) is not confirmed and is constrained by heap-hardening mitigations on the host.
Impact

Signals are mixed and warrant nuance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) describes a network-reachable, low-complexity, unauthenticated, high-impact flaw, and publicly available exploit code plus a clear memory-corruption primitive reinforce technical severity. However, the EPSS score is very low (0.08%, 24th percentile) and the CVE is NOT in CISA KEV, indicating no observed widespread or active exploitation at time of analysis. The CVSS 'network' vector reflects ImageMagick's typical exposure inside upload/processing pipelines rather than a listening network service - actual reachability depends on an application accepting and processing attacker-supplied images, so PR:N/AV:N is realistic for most web deployments but not universal. Whether the heap overflow yields reliable RCE versus a crash/DoS is not confirmed by the available data; modern heap hardening (ASLR, allocator protections) often reduces controlled overflows to denial of service. Net: treat as a high-priority patch for any internet-facing image-processing service, while recognizing the low EPSS suggests exploitation is currently more theoretical/targeted than mass-scanned.
Exploit ScenarioDerived

An attacker crafts a malicious XBM file whose declared geometry and pixel data are tuned to overflow the heap allocation in ReadXBMImage, then uploads it to a web application that uses ImageMagick to generate thumbnails or identify the image. When the server processes the upload, the decoder writes controlled data past the buffer, corrupting heap memory to crash the service or potentially achieve code execution; public exploit code for this flaw exists.
Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv5 – Jun 30, 2026

Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled data past an allocated heap buffer by submitting a maliciously crafted XBM file, affecting all versions prior to 7.1.2-13 and 6.9.13-38. Because any read or identify operation triggers the flaw, it is reachable through ordinary image upload and conversion pipelines, raising the risk of memory corruption and potential remote code execution. Publicly available exploit code exists and a vendor patch is available, though EPSS exploitation probability remains low (0.08%) and it is not listed in CISA KEV.

Earlier versions of this analysis (4)
v4 Jun 30, 2026 - 04:08 cvss changed CVSS 9.8

Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled data past an allocated heap buffer by supplying a crafted XBM file, with the CVSS:3.1/AV:N/PR:N vector indicating unauthenticated triggering. Because any read or identify operation on the image fires the bug, it is reachable through ordinary image upload and conversion pipelines, making it a strong RCE/corruption candidate; publicly available exploit/PoC material exists via the GitHub security advisory, though the EPSS probability is currently low (0.08%, 24th percentile) and it is not in CISA KEV. Affected builds are everything prior to 7.1.2-13 and 6.9.13-38, which contain the fix.

v3 Jun 30, 2026 - 04:06 cvss changed CVSS 9.8

Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write controlled data beyond an allocated heap buffer by supplying a crafted XBM file, with CVSS 9.8 reflecting potential remote code execution and full compromise of confidentiality, integrity, and availability. Because any read or identify operation triggers the flaw, it is reachable through ordinary image upload and conversion pipelines that use ImageMagick. Publicly available exploit code exists via the GitHub security advisory, though EPSS exploitation probability is low (0.08%, 24th percentile) and there is no public exploit identified as actively used in the wild.

v2 Jun 30, 2026 - 04:06 cvss changed CVSS 9.8

Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled data past an allocated heap buffer by submitting a crafted XBM file, enabling memory corruption that can escalate to remote code execution. Affects ImageMagick before 7.1.2-13 and 6.9.13-38, and is dangerous because any read or identify operation triggers it, exposing common image-upload pipelines. Publicly available exploit code exists, though the EPSS probability is low (0.08%); no public report of active exploitation at time of analysis.

v1 Mar 12, 2026 - 21:54 CVSS 8.1

ImageMagick is free and open-source software used for editing and manipulating digital images. [CVSS 8.1 HIGH]

RemediationAI

Vendor-released patch: upgrade to ImageMagick 7.1.2-13 or 6.9.13-38 (or later) per advisory https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r49w-jqq3-3gx8; the upstream fix is commit 2fae24192b78fdfdd27d766fd21d90aeac6ea8b8. On managed distributions apply the corresponding packages from Red Hat (https://access.redhat.com/errata/RHSA-2026:3058) or SUSE (https://www.suse.com/support/update/SUSE-SU-2026:0384/ and the 0437/0438/0503 updates) and restart services that link the library. Where immediate patching is not possible, disable the XBM coder via a policy.xml entry such as <policy domain="coder" rights="none" pattern="XBM"/>, which blocks the vulnerable decoder at the cost of losing XBM read/write support; additionally validate and restrict uploaded image formats to an explicit allowlist and enforce ImageMagick resource limits, accepting that content-based format detection means file-extension filtering alone is insufficient.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

ImageMagick is a widely embedded image-processing toolkit (and library, via delegates like the PHP Imagick extension and numerous web frameworks) that automatically dispatches files to format-specific decoders. The flaw is in the XBM coder's ReadXBMImage routine; XBM (X BitMap) is a legacy C-source-style monochrome bitmap format whose dimensions and pixel data are parsed from the file itself. The root cause is CWE-122 (heap-based buffer overflow): the decoder allocates a heap buffer based on header-declared geometry but writes decoded pixel data beyond that allocation when the crafted file's contents exceed the computed bounds. Affected CPE is cpe:2.3:a:imagemagick:imagemagick across all versions below the fixed releases. Because ImageMagick auto-detects formats by content, the XBM coder can be reached even when a caller never explicitly requests XBM handling.

Know when Imagemagick gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 9.8 CRITICAL

Untrusted XBM reaches the decoder through unauthenticated upload pipelines with no user interaction (AV:N/AC:L/PR:N/UI:N); a controlled heap overflow plausibly threatens confidentiality, integrity, and availability.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat 8.1 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

9
Analysis Updated
Jun 30, 2026 - 04:08 vuln.today
v5 - CVSS changed
Analysis Updated
Jun 30, 2026 - 04:08 vuln.today
v4 - CVSS changed
Analysis Updated
Jun 30, 2026 - 04:06 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 30, 2026 - 04:06 vuln.today
v2 - CVSS changed
Severity Changed
Jun 30, 2026 - 03:23 NVD
HIGH CRITICAL
CVSS changed
Jun 30, 2026 - 03:23 NVD
8.1 (HIGH) 9.8 (CRITICAL)
PoC Detected
Jan 29, 2026 - 13:54 vuln.today
Public exploit code
Patch released
Jan 29, 2026 - 13:54 nvd
Patch available
CVE Published
Jan 20, 2026 - 01:15 nvd
HIGH 8.1

DescriptionNVD

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the XBM image decoder (ReadXBMImage) allows an attacker to write controlled data past the allocated heap buffer when processing a maliciously crafted image file. Any operation that reads or identifies an image can trigger the overflow, making it exploitable via common image upload and processing pipelines. Versions 7.1.2-13 and 6.9.13-38 fix the issue.

Executive ViewAI

Why It Matters

A critical code execution flaw in ImageMagick affects all versions prior to 7.1.2-13 and 6.9.13-38, allowing attackers to compromise servers by uploading malicious image files. Publicly available exploit code exists for this vulnerability. Any organization processing images from untrusted sources faces immediate risk without patching.

Business Impact: Severe
Compensating Controls

Apply vendor patch. Interim: Disable ImageMagick-based image processing for untrusted input; implement network segmentation to restrict image processing to isolated systems; add file extension/MIME validation to reject XBM files if not business-critical.

Threat Intelligence Overview

EPSS Score
0.1%
Top 76% exploitable
Prevalence
Ubiquitous
image-processing library embedded across countless web apps and Linux distros
Exploit
POC
Public exploit code exists
Data Quality
6 sources
Confidence: High
NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC Yes
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity + public POC available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Very High

Priority Score

69
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Affected Products (CPE)NVD

cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*

More in Imagemagick

View all
CVE-2016-3714 HIGH POC
8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
CVE-2016-3718 MEDIUM POC
5.5 May 05

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct

CVE-2016-3715 MEDIUM POC
5.5 May 05

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary fi
CVE-2017-15277 MEDIUM POC
6.5 Oct 12

ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
CVE-2016-5841 CRITICAL POC
9.8 Dec 13

Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
CVE-2016-3717 MEDIUM POC
5.5 May 05

The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
CVE-2016-5118 CRITICAL
9.8 Jun 10

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
CVE-2016-5689 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2016-5690 CRITICAL POC
9.8 Dec 13

The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to

CVE-2016-5691 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2017-14138 CRITICAL POC
9.8 Sep 04

ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
CVE-2025-57807 CRITICAL POC
9.8 Sep 05

Heap-based out-of-bounds write in ImageMagick's memory-backed BlobStream I/O (MagickCore/blob.c) allows remote, unauthen

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.41 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.62 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.65 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.54 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed

References

Advisories & patches
PATCH https://github.com/ImageMagick/ImageMagick/commit/2fae24192b78fdfdd27d766fd21d90aeac6ea8b8 ADVISORY https://access.redhat.com/errata/RHSA-2026:3058 ADVISORY https://vuldb.com/vuln/341910 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0384/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0437/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0438/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0503/ REF https://access.redhat.com/security/cve/CVE-2026-23876 REF https://bugzilla.redhat.com/show_bug.cgi?id=2431038 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23876.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy