CVE-2026-119123

A flaw was found in ImageMagick. This vulnerability allows an attacker to cause a Denial of Service (DoS) by submitting a specially crafted image file for processing. When the Digital Negative (DNG) decoder is disabled, processing the file triggers a stack overflow in the TIFF decoder, leading to an application crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, disable processing of TIFF image files by adding a coder restriction to the ImageMagick security policy.

1. Open the ImageMagick security policy file (/etc/ImageMagick-6/policy.xml on RHEL 8 or /etc/ImageMagick-7/policy.xml where ImageMagick 7 is used) in a text editor.
2. Add the following rule inside the <policymap> section:

<policy domain="coder" rights="none" pattern="TIFF" />

Alternatively, if the DNG decoder was manually disabled in the policy file, removing that restriction to allow DNG processing will prevent triggering this code path.

Caveats: Disabling the TIFF coder completely prevents ImageMagick from reading or converting TIFF formatted images. Application services or background workers that integrate ImageMagick libraries directly may need to be restarted to load the new policy configuration.