CVE-2026-55594: ImageMagick MVG Decoder Stack Overflow Vulnerability – Patch Now

Technical summary

CVE-2026-55594 is a stack overflow vulnerability in ImageMagick's MVG decoder stemming from insufficient depth validation during recursive image parsing. The CWE-674 (uncontrolled recursion) and CWE-400 (uncontrolled resource consumption) classifications indicate that malformed MVG structures can trigger unbounded recursion without hitting a depth limit, exhausting stack memory. The CVSS 3.1 score of 5.3 (Medium) reflects network accessibility, low attack complexity, and availability impact with no confidentiality or integrity compromise—an attacker needs only to send a crafted image without authentication or user interaction.

Business impact

This vulnerability creates operational disruption risk for organizations that process untrusted image files through ImageMagick-dependent services. Web applications using ImageMagick for thumbnail generation, image format conversion, or graphics processing could crash when handling attacker-supplied files. For SaaS platforms accepting user uploads, this becomes a readily-exploitable denial-of-service vector requiring no authentication. The impact is confined to availability; attackers cannot read sensitive data or modify systems. However, repeated crashes can degrade service quality and exhaust infrastructure resources.

Affected systems

ImageMagick versions prior to 6.9.13-51 (the stable/legacy 6.x branch) and versions prior to 7.1.2-26 (the current 7.x branch) are vulnerable. Any system or application embedding ImageMagick as a library—including web frameworks, content management systems, media processing pipelines, and containerized microservices—is affected if running an unpatched version. Organizations should inventory instances of ImageMagick across development, testing, and production environments, particularly in image upload or batch-processing workflows.

Exploitability

Exploitation is straightforward: an attacker crafts a malicious MVG-format image file with deeply nested or recursive structures that circumvent the decoder's missing depth check. Sending this file to any application processing ImageMagick images triggers a stack overflow and crash. No authentication or user privileges are required, and the attack succeeds over a network if the vulnerable application is accessible. The low attack complexity and lack of preconditions make this suitable for automated scanning and exploitation. However, without a public exploit actively weaponized in the wild, many organizations may not immediately prioritize this. It is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade ImageMagick to version 6.9.13-51 or later (if using the 6.x branch) or to version 7.1.2-26 or later (if using the 7.x branch). For organizations unable to patch immediately, implement network-level restrictions on image uploads, validate file signatures before processing, or disable MVG format support if it is not required for business use. Consider sandboxing ImageMagick processes in containers or separate security contexts to limit the blast radius of a crash. Verify all dependent applications have been tested after updating, as ImageMagick updates can occasionally affect image output quality or functionality.

Patch guidance

Update ImageMagick through your package manager (apt, yum, homebrew, etc.) or by downloading official binaries from the ImageMagick website. Verify the installed version with 'identify -version' to confirm it meets or exceeds the fixed versions. If ImageMagick is embedded in a third-party application, check that application vendor's release notes for a corresponding patch; many depend on ImageMagick and may require their own update cycle. Test patched environments thoroughly in a staging setting before production deployment, as image processing behavior may change. Document the update for audit and compliance purposes.

Detection guidance

Monitor application logs for crashes or segmentation faults correlated with image file uploads or processing. On Unix-like systems, check system logs (dmesg, journalctl) for stack overflow or segfault messages. Inspect network traffic for unusual image uploads, particularly files claiming to be MVG format or containing deeply nested XML-like structures. Deploy file type validation at ingestion points to reject or quarantine unexpected or suspicious image formats. Consider deploying an intrusion detection system (IDS) rule that flags attempts to upload files with recursive or excessively deep structures. Baseline normal image processing behavior to identify sudden crash patterns.

Why prioritize this

Although assigned a Medium CVSS score, this vulnerability merits prompt attention because (1) ImageMagick is pervasive in web and media processing environments, (2) the attack requires no authentication or user interaction, (3) it is network-accessible, and (4) it can trivially disable critical image-processing pipelines. Organizations accepting user-uploaded images should prioritize this in the next 2-4 week patching cycle. Those using ImageMagick in internal-only, non-critical workflows may defer slightly, but the fix is relatively low-risk and widely available. The absence of active KEV listing should not be mistaken for low risk—it reflects late publication or limited known exploitation, not vulnerability severity.

Risk score, explained

CVSS 3.1 assigns a score of 5.3 (Medium) because the vulnerability is network-reachable (AV:N), requires no special privileges (PR:N), requires no user interaction (UI:N), and impacts only availability (A:L, with C:N and I:N). Attack complexity is low (AC:L), meaning the attacker does not need to overcome special deployment conditions. The score would be higher if the vulnerability enabled remote code execution or escalated privileges; it remains moderate because the outcome is denial of service. In risk context, Medium does not mean 'acceptable delay'—it means the impact and exploitability warrant a swift response within standard vulnerability management SLAs.

Frequently asked questions