CVE-2026-48994: ImageMagick MAT Decoder Heap Buffer Overflow on 32-bit Systems

Technical summary

CVE-2026-48994 involves a missing return value check in ImageMagick's MAT decoder that leads to heap buffer overflow on 32-bit architectures. The vulnerability (CWE-122: Heap-based Buffer Overflow) occurs when the decoder processes a specially crafted MAT file without validating whether a critical operation succeeded. The unchecked return value allows subsequent writes to corrupt heap memory beyond allocated boundaries. The CVSS 3.1 score of 5.9 (MEDIUM severity) reflects that exploitation requires a high attack complexity and produces denial-of-service impact; code execution potential is limited by memory layout dependencies and the need to control heap state during processing.

Business impact

Organizations relying on ImageMagick for automated image processing—including web applications, content management systems, batch image conversion pipelines, and graphics preprocessing—face availability risk. A denial-of-service via crafted image upload or remote file processing could interrupt service. While the severity is rated MEDIUM, the wide deployment of ImageMagick in containerized and cloud environments means this affects many organizations indirectly. Companies should assess whether untrusted users can upload or reference MAT files; if so, patching becomes higher priority despite the MEDIUM rating.

Affected systems

ImageMagick versions prior to 6.9.13-48 (legacy series) and 7.1.2-24 (current series) are affected. Vulnerability applies only to 32-bit builds; 64-bit systems are unaffected due to memory layout differences that prevent the overflow from reaching exploitable heap regions. Systems running older 6.9.x versions, particularly those in long-term support environments, are at higher risk if not actively patched. Verify your exact version with 'identify -version' or your package manager.

Exploitability

Exploitation requires crafting a malicious MAT image file and delivering it to a vulnerable ImageMagick process. The attack complexity rating reflects that an attacker must manipulate heap conditions or craft a specific file structure; passive exploitation is unlikely. No public exploit code is known, and the issue has not been added to CISA's Known Exploited Vulnerabilities catalog. However, the low barrier to crafted file delivery (email attachment, web upload, RSS image feed) and the common presence of ImageMagick in automation pipelines mean opportunistic attackers may begin testing once public details emerge.

Remediation

Upgrade to ImageMagick 6.9.13-48 or later (6.9.x branch) or 7.1.2-24 or later (7.x branch). Prioritize 32-bit deployments. After patching, restart any services or containers using ImageMagick. For systems unable to patch immediately, consider disabling MAT file support or restricting image input sources to trusted, pre-validated formats until patching is complete. Validate patch application with 'identify -version' to confirm the patched version is in use.

Patch guidance

1. Check your current version: Run 'convert -version' or check your package manager. 2. Identify 32-bit deployments: These are at risk; 64-bit systems are not vulnerable. 3. Test patches in a staging environment first, especially if ImageMagick is critical to your workflow. 4. For compiled or container-based deployments, rebuild with the patched source code or pull updated base images. 5. Restart dependent services after patching to ensure new code is in use. 6. For distributions using package managers, patches may be backported to older version series; check your vendor's security advisories.

Detection guidance

Monitor ImageMagick error logs for crashes or unexpected terminations when processing image files, particularly MAT format images. On 32-bit systems, watch for heap corruption indicators: segmentation faults in ImageMagick processes, memory sanitizer alerts if enabled, or unusual process terminations. Network-based detection is limited since the attack is file-based; focus on file integrity monitoring for image repositories and logging of image upload/processing events. If using a Web Application Firewall, flag uploads with MAT magic bytes or .mat extensions from untrusted sources. Enable core dump analysis if available to confirm heap overflow signatures in crash data.

Why prioritize this

Although rated MEDIUM severity, this vulnerability warrants near-term patching because: (1) ImageMagick is ubiquitous in web and automation environments, (2) the attack vector is network-accessible (file upload, remote processing), (3) 32-bit deployments remain common in legacy systems and embedded devices, and (4) denial-of-service risk directly impacts service availability. Prioritize any 32-bit systems or those accepting untrusted image input. 64-bit systems can be deprioritized but should still be patched in routine cycles.

Risk score, explained

CVSS 3.1 MEDIUM (5.9) is assigned due to: High attack complexity (need for crafted file + heap state control), no authentication required (network accessible), no confidentiality or integrity impact (denial-of-service only), and availability impact (crash or hang). The score would be higher if code execution were reliably achievable, but memory layout randomization and limited control over crash behavior lower the practical impact. Organizations with high uptime requirements should treat this as higher priority internally, even if the numeric score is MEDIUM.

Frequently asked questions