CVE-2026-116149
Description
A flaw was found in ImageMagick. A stack-based buffer overflow vulnerability exists in the handling of bzip2 compressed images, where stack memory can be overwritten during decoding. By submitting a specially crafted image, an attacker can exploit this issue to cause memory corruption or crash the application, resulting in a Denial of Service (DoS).
Statement
This flaw is rated as having an Important impact for Red Hat products because a stack buffer overflow can lead to application crashes or potentially allow arbitrary code execution within the security context of the running process. In typical Red Hat deployments, ImageMagick is used either via local CLI utilities or as a backend component in web applications and automated processing pipelines. Exploitation requires an application or user to parse a specially prepared graphic file utilizing bzip2 compression, limiting the blast radius to the permissions and boundaries of the executing service.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-02) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce bounds checking and stack protector canaries during the decoding of bzip2 compressed images in ImageMagick: upgrade to ImageMagick 6.9.13-58, 7.1.2-33+ (or the fixed Imagemagick builds), which prevents stack memory from being overwritten during the decoding of bzip2 compressed images, closing crafted bzip2-compressed image file. Until patched, this is a concern on Deployments running ImageMagick CLI utilities, web backends, or automated pipelines processing untrusted bzip2-compressed images, so Restrict ImageMagick from processing untrusted bzip2-compressed files or isolate image processing pipelines to limit execution privileges. As a compensating measure, Enable Address Space Layout Randomization to randomize stack and library layout and obstruct control flow redirection, Enable Control Flow Integrity or a shadow call stack to isolate return addresses and prevent control-flow hijacking, Enable FORTIFY_SOURCE buffer overflow detection to catch out-of-bounds writes to stack buffers at runtime, and Enforce NX/XD bit non-executable memory protection to prevent execution of injected stack shellcode. These controls limit blast radius and contain exploitation, but they do not fix the underlying stack-based buffer overflow defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-103 Stack Canaries (Stack Protector) (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | 8.1 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | Low |
| User Interaction | Required | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
