CVE-2026-116149

A flaw was found in ImageMagick. A stack-based buffer overflow vulnerability exists in the handling of bzip2 compressed images, where stack memory can be overwritten during decoding. By submitting a specially crafted image, an attacker can exploit this issue to cause memory corruption or crash the application, resulting in a Denial of Service (DoS).

This flaw is rated as having an Important impact for Red Hat products because a stack buffer overflow can lead to application crashes or potentially allow arbitrary code execution within the security context of the running process. In typical Red Hat deployments, ImageMagick is used either via local CLI utilities or as a backend component in web applications and automated processing pipelines. Exploitation requires an application or user to parse a specially prepared graphic file utilizing bzip2 compression, limiting the blast radius to the permissions and boundaries of the executing service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

--- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to enforce bounds checking and stack protector canaries during the decoding of bzip2 compressed images in ImageMagick: upgrade to ImageMagick 6.9.13-58, 7.1.2-33+ (or the fixed Imagemagick builds), which prevents stack memory from being overwritten during the decoding of bzip2 compressed images, closing crafted bzip2-compressed image file. Until patched, this is a concern on Deployments running ImageMagick CLI utilities, web backends, or automated pipelines processing untrusted bzip2-compressed images, so Restrict ImageMagick from processing untrusted bzip2-compressed files or isolate image processing pipelines to limit execution privileges. As a compensating measure, Enable Address Space Layout Randomization to randomize stack and library layout and obstruct control flow redirection, Enable Control Flow Integrity or a shadow call stack to isolate return addresses and prevent control-flow hijacking, Enable FORTIFY_SOURCE buffer overflow detection to catch out-of-bounds writes to stack buffers at runtime, and Enforce NX/XD bit non-executable memory protection to prevent execution of injected stack shellcode. These controls limit blast radius and contain exploitation, but they do not fix the underlying stack-based buffer overflow defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-103 Stack Canaries (Stack Protector) (high)