CVE-2026-46559: ImageMagick JP2 Heap Buffer Overflow – MEDIUM Severity

Technical summary

CVE-2026-46559 is a heap buffer overflow vulnerability in ImageMagick's JP2 codec. The root cause is an insufficient validation check (CWE-193, off-by-one error) combined with improper bounds handling (CWE-787, out-of-bounds write). When a JP2 file is processed with specific options that trigger the vulnerability path, ImageMagick writes one byte past the boundary of a heap-allocated buffer. The single-byte nature of the overflow constrains exploitation but does not eliminate risk entirely, particularly in scenarios where heap metadata or adjacent objects contain sensitive data or control structures. Exploitation requires local file access and the ability to supply a crafted JP2 image to ImageMagick.

Business impact

Organizations running ImageMagick—common in web servers, automated image processing pipelines, content management systems, and design workflows—face localized availability risk. An attacker who can supply malicious JP2 files (via file upload features, image processing services, or batch operations) may trigger denial of service. The impact is contained to the process handling the image and does not directly leak data or grant code execution on the affected system. However, in environments where ImageMagick processes untrusted user uploads at scale, repeated crashes could degrade service availability. Patching is recommended to eliminate the attack vector entirely.

Affected systems

ImageMagick versions 6.9.13-47 and earlier in the 6.9.x series, and versions 7.1.2-22 and earlier in the 7.1.x series are affected. The vulnerability is triggered only when processing JP2-format image files, so environments that use ImageMagick exclusively for other formats (JPEG, PNG, GIF, etc.) are not exposed. Systems with strict input validation or that reject JP2 files at the network/application layer are also protected. Verify your installed version via `identify -version` or check packaging metadata.

Exploitability

Exploitation requires local or authenticated access to supply a malicious JP2 file to an ImageMagick process. The attack does not propagate remotely, nor does it yield command execution or privilege escalation. An attacker cannot trigger the flaw by merely viewing or sharing an image file passively; ImageMagick must actively process the JP2 with specific decoding options. The barrier to exploitation is low once an attacker can influence file input, making this vulnerability relevant in automated or user-facing image processing scenarios. It is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade ImageMagick to version 6.9.13-48 (for the 6.9 branch) or 7.1.2-23 (for the 7.1 branch) or later. These versions contain the patched JP2 validation logic. Organizations unable to upgrade immediately should restrict JP2 file processing—configure application settings to reject or skip JP2 input, or implement file-type filtering at the application or network boundary. Monitor logs for unusual ImageMagick crashes or exceptions when processing image files, as these may signal exploitation attempts.

Patch guidance

Consult your ImageMagick distribution channel (official repository, vendor package manager, or compiled source) to obtain the fixed versions. For source builds, verify the commit hash or release tag matches 6.9.13-48 or 7.1.2-23 or later. For packaged distributions, check release notes to confirm JP2 codec inclusion and the specific patched version. After patching, restart services that depend on ImageMagick to ensure the updated library is loaded. Test with sample JP2 files to confirm processing still functions correctly.

Detection guidance

Monitor process logs and application error logs for crashes or abnormal termination of ImageMagick or services using it (web servers, batch processors, APIs). Watch for repeated exceptions linked to JP2 image handling or file operations. Intrusion detection systems may flag attempts to upload unusual or malformed JP2 files, though such detection requires knowledge of your normal image upload profile. Heap buffer overflows can leave subtle traces; enable Address Sanitizer (ASAN) or memory debugging tools during testing to catch the write if reproduction is possible. File integrity monitoring on ImageMagick binaries will alert if the vulnerable version is reinstalled after patching.

Why prioritize this

This vulnerability merits timely but not emergency remediation. The CVSS 3.1 score of 4.0 (MEDIUM) reflects the local attack vector, lack of network exposure, and absence of confidentiality or integrity impact. However, the flaw is in a ubiquitous image library, and organizations with user-facing image upload or processing features should prioritize patching to prevent denial-of-service incidents. It is not on the active exploitation list (no KEV status), lowering immediate urgency relative to critical or widely exploited flaws. Plan patching within standard maintenance windows, prioritizing systems that process untrusted or user-supplied images.

Risk score, explained

The CVSS 3.1 score of 4.0 reflects: (1) Local attack vector—attacker must supply a file to the vulnerable process, not exploit remotely; (2) Low attack complexity—no special conditions or privileges needed beyond file access; (3) No user interaction required—the overflow triggers automatically during processing; (4) No impact on confidentiality or integrity—the flaw results only in process termination; (5) Low availability impact—crash of a single process instance, not system-wide outage. The single-byte overflow nature and lack of code-execution potential prevent a higher score. Organizations with robust input validation or that disable JP2 handling face minimal practical risk.

Frequently asked questions