CVE-2026-46521 ImageMagick LZMA Out-of-Bounds Write – Patch & Detection Guide

Technical summary

CVE-2026-46521 is an out-of-bounds write vulnerability (CWE-787) in ImageMagick's MIFF encoder when LZMA compression is used. The root cause is a missing bounds check during compression operations, allowing an attacker to write beyond buffer limits. The vulnerability also relates to improper exception handling (CWE-252) and integer underflow conditions (CWE-131, CWE-835). The CVSS 3.1 score of 5.5 (MEDIUM) reflects local attack vector, no user privilege requirement, but significant availability impact. Exploitation requires user interaction to open a malicious image file.

Business impact

Organizations using ImageMagick for automated image processing, content management systems, or web-based image editing services face denial-of-service risk. If ImageMagick runs with elevated privileges or in a service context processing untrusted images, memory corruption could lead to application crashes, service interruptions, or unpredictable behavior. The vulnerability is not currently exploited in the wild (not on CISA KEV list), reducing immediate threat but warranting planned remediation.

Affected systems

ImageMagick versions prior to 6.9.13-48 and 7.1.2-23 are vulnerable. This includes any deployment running the legacy 6.9.x series or the 7.1.x series before the specified patch versions. Systems that process user-supplied images or integrate ImageMagick into document processing, thumbnail generation, or graphic conversion pipelines are at risk.

Exploitability

Exploitation requires local access and user interaction—specifically, convincing or tricking a user to open a malicious MIFF image file with LZMA compression enabled. The barrier to exploitation is moderate: an attacker must craft a specific file type that ImageMagick will process. No network vector, no privilege escalation, and no authentication bypass is present. The likelihood of accidental triggering via legitimate workflows is low.

Remediation

Upgrade ImageMagick to version 6.9.13-48 or later for the legacy branch, or to version 7.1.2-23 or later for the current branch. Organizations should verify their deployment branch before patching. For environments unable to patch immediately, restrict image processing to trusted sources and consider disabling LZMA compression support if operationally feasible.

Patch guidance

Check your current ImageMagick version using `identify -version`. If you are on the 6.9.x branch (legacy, no longer actively maintained), update to 6.9.13-48 or migrate to the 7.1.x series. If on 7.1.x, update to 7.1.2-23 or later. Many Linux distributions and package managers provide ImageMagick; verify patch availability through your distribution's security advisories. Vendors and applications embedding ImageMagick (such as PHP ImageMagick extensions, Python bindings, or custom integrations) should also be updated.

Detection guidance

Monitor for crashes or unexpected termination of ImageMagick-dependent services when processing MIFF files. Audit logs may show segmentation faults or memory protection violations. Network-based detection is unlikely since the vulnerability is local. Consider enabling application-level logging for ImageMagick operations and correlate with system-level memory errors. Intrusion detection systems cannot easily flag this without deep inspection of MIFF file structure and compression headers.

Why prioritize this

Although the CVSS score is MEDIUM (5.5) and the vulnerability is not yet weaponized in the wild, it should be treated as a baseline maintenance priority. Organizations heavily reliant on ImageMagick for content processing (media sites, document management, SaaS platforms) should prioritize within the next 30–60 days. Lower-priority for organizations with minimal ImageMagick usage or robust input validation. The lack of KEV inclusion indicates no active exploitation campaign, allowing time for deliberate planning.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects: (1) local attack vector (AV:L)—requiring either local system access or user interaction; (2) no authentication needed (PR:N); (3) single context (S:U); (4) no confidentiality or integrity impact (C:N, I:N); (5) high availability impact (A:H)—the out-of-bounds write can crash the process. The score does not account for real-world factors like limited MIFF adoption or the requirement to convince users to open a crafted file, which in practice lower risk for most organizations.

Frequently asked questions