CVE-2026-119123
Description
A flaw was found in ImageMagick. This vulnerability allows an attacker to cause a Denial of Service (DoS) by submitting a specially crafted image file for processing. When the Digital Negative (DNG) decoder is disabled, processing the file triggers a stack overflow in the TIFF decoder, leading to an application crash.
Mitigation
To mitigate this vulnerability, disable processing of TIFF image files by adding a coder restriction to the ImageMagick security policy.
1. Open the ImageMagick security policy file (`/etc/ImageMagick-6/policy.xml` on RHEL 8 or `/etc/ImageMagick-7/policy.xml` where ImageMagick 7 is used) in a text editor.
2. Add the following rule inside the `<policymap>` section:
xml
<policy domain="coder" rights="none" pattern="TIFF" />
Alternatively, if the DNG decoder was manually disabled in the policy file, removing that restriction to allow DNG processing will prevent triggering this code path.
Caveats:
Disabling the TIFF coder completely prevents ImageMagick from reading or converting TIFF formatted images. Application services or background workers that integrate ImageMagick libraries directly may need to be restarted to load the new policy configuration.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.7 | 7.5 | 3.7 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | High | Low | High |
| Privileges Required | None | None | None |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | None |
| Integrity Impact | None | None | None |
| Availability Impact | Low | High | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
