CVE-2026-42326: ImageMagick IPTC Out-of-Bounds Read (Medium, 5.1 CVSS)

Technical summary

CVE-2026-42326 is an out-of-bounds read vulnerability in ImageMagick's IPTC output handler. When processing a malicious input file during IPTC metadata writing, the code fails to properly validate buffer boundaries, allowing a single-byte read past the intended memory region. The vulnerability is rooted in improper bounds checking (CWE-125: Out-of-bounds Read) combined with potential integer underflow or signedness confusion (CWE-191). The flaw affects ImageMagick versions prior to 6.9.13-47 (legacy branch) and 7.1.2-22 (current branch). Exploitation requires local access and the ability to provide input to ImageMagick's IPTC writing functionality, typically through image processing workflows.

Business impact

Organizations relying on ImageMagick for automated image processing—such as content management systems, photo galleries, document conversion pipelines, or media asset management platforms—face potential information disclosure and service disruption. A malicious image uploaded or processed through these systems could leak snippets of memory containing cached credentials, configuration secrets, or other sensitive data. Availability is also at risk if the out-of-bounds access triggers a crash. For systems processing untrusted user-supplied images, this represents a meaningful risk to confidentiality and operational continuity.

Affected systems

ImageMagick versions 6.9.13-46 and earlier (6.x branch) and 7.1.2-21 and earlier (7.x branch) are vulnerable. Any deployment using these versions to process IPTC metadata—including web servers running image manipulation libraries, containerized microservices, and batch image processing jobs—requires immediate attention. Check your ImageMagick version with `convert -version` or equivalent. Note that many Linux distributions and container images bundle ImageMagick, so patching may require updating your base system or rebuilding images.

Exploitability

This vulnerability requires local access and the ability to provide a malicious image file as input to ImageMagick's IPTC writing function. The attack is not remotely exploitable in the default configuration, but network-accessible image processing services (APIs, web uploads) that feed images to vulnerable ImageMagick instances become indirect attack vectors. No user interaction is required once the malicious file is processed. The CVSS score of 5.1 (Medium) reflects the local requirement, limited impact scope (single-byte read), and mixed consequences (some information leak coupled with potential availability impact).

Remediation

Upgrade ImageMagick to version 6.9.13-47 or later (6.x series) or 7.1.2-22 or later (7.x series). For distributions, check your package manager for patched versions. Verify the patch by running `convert -version` and confirming the version number. In the interim, restrict the ability to upload or process untrusted images through ImageMagick-dependent services, and run ImageMagick with minimal privileges and memory constraints where possible.

Patch guidance

Apply the official ImageMagick updates from your vendor or distribution repository. Verify that you are upgrading to ImageMagick 6.9.13-47 (or later in the 6.9.x series) or 7.1.2-22 (or later in the 7.1.x series). For Docker and containerized deployments, rebuild images with the patched ImageMagick version. Test the update in a staging environment with your image processing workflows to confirm compatibility before deploying to production. Some distributions may have backported the fix to earlier version numbers—consult your vendor advisory for the exact version to target.

Detection guidance

Monitor for unexpected crashes or errors in ImageMagick-dependent services when processing images, particularly those containing IPTC metadata. Enable verbose logging in your image processing pipelines to capture image filenames and processing outcomes. Use file integrity monitoring on systems running vulnerable ImageMagick versions to detect unauthorized changes. Network-based detection is limited due to the local nature of the flaw, but you can audit image uploads and file-processing logs for suspicious or malformed image submissions. Vulnerability scanners can identify ImageMagick versions via binary inspection or package queries.

Why prioritize this

Assign medium-to-high priority based on your exposure: (1) If you process untrusted user-supplied images (web uploads, APIs), prioritize patching immediately. (2) If ImageMagick is internal-only and air-gapped, the risk is lower but still warrants prompt attention. (3) The vulnerability is not yet in active exploitation (not on the KEV catalog), offering a window for orderly patching before widespread campaigns emerge. The CVSS score of 5.1 reflects medium severity, but real-world impact depends on what sensitive data resides in the process memory of your image-handling services.

Risk score, explained

CVSS 3.1 score of 5.1 (Medium) is computed as: Attack Vector Local (requires filesystem or local service access), Attack Complexity Low (no special conditions), Privileges None (no elevated rights needed), User Interaction None (automatic upon file processing), Scope Unchanged (no lateral impact), Confidentiality Low (single-byte leak), Integrity None, Availability Low (potential crash). The score appropriately reflects the local-only attack surface and modest scope of the information leak, while acknowledging the practical risk to confidentiality and availability in image-processing workflows.

Frequently asked questions