CVE-2026-55597: ImageMagick JP2 Heap Buffer Overflow Denial of Service

Technical summary

CVE-2026-55597 is a heap buffer over-write (CWE-787) stemming from incorrect argument handling in ImageMagick's JP2 encoder. The vulnerability allows an attacker to trigger out-of-bounds write operations when the encoder processes input with malformed or unexpected parameter values. The flaw also relates to CWE-682 (incorrect computation), suggesting the root cause involves flawed logic in parameter validation or buffer sizing. The attack vector is local and requires user action to open a malicious image file. Exploitation results in a crash or potential memory corruption, classified as a denial of service impact.

Business impact

Organizations relying on ImageMagick for automated image processing pipelines—such as web applications that handle user-uploaded images, content management systems, or batch image conversion services—face availability risk. A user-supplied JP2 file could crash the ImageMagick process, interrupting workflows. In environments where ImageMagick runs with elevated privileges or in shared infrastructure, the memory corruption could theoretically be leveraged for privilege escalation, though the primary documented impact is denial of service. The need for user interaction (opening the file) limits blast radius compared to remote code execution vulnerabilities, but unattended batch processing is still vulnerable.

Affected systems

ImageMagick versions before 7.1.2-26 are vulnerable. This includes all 7.1.x releases up to and including 7.1.2-25, as well as older stable branches (7.0.x) unless they have been patched separately. Organizations should verify their exact ImageMagick deployment version. The vulnerability is present in both source builds and packaged distributions (Linux distros, Homebrew, etc.). Web services and applications embedding ImageMagick for image handling are at risk, particularly those accepting JP2 uploads.

Exploitability

Exploitability is moderate. An attacker must craft a malicious JP2 image and convince or trick a user into processing it via ImageMagick—directly or through an application. The vulnerability does not allow remote code execution or data exfiltration; it crashes the process. However, the low barrier to creating a test JP2 file and the common nature of image handling make this a practical denial-of-service vector. No known public exploit code was indexed in vulnerability databases at the time of publication, and the vulnerability is not on the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning in-the-wild exploitation has not been formally confirmed. Nonetheless, proof-of-concept development is straightforward.

Remediation

Upgrade ImageMagick to version 7.1.2-26 or later. Users should prioritize this patch if their organization processes untrusted JP2 images. Verify compatibility with dependent applications before deploying, as ImageMagick version changes can occasionally affect image output or API behavior. If immediate patching is not feasible, implement defensive measures: disable JP2 encoding/decoding if not required, validate and sandbox image uploads, and run ImageMagick in a restricted environment with minimal privileges.

Patch guidance

Verify your current ImageMagick version using `identify -version` (command-line) or the API equivalent in your application. If running version 7.1.2-25 or earlier, update to 7.1.2-26 or a later release. Check your distribution's package manager for updates (e.g., `apt update && apt upgrade imagemagick` on Debian/Ubuntu). If building from source, download the patched release from the official ImageMagick repository. Test the patch in a non-production environment first, particularly for applications heavily dependent on image processing, to confirm no regressions.

Detection guidance

Monitor for crashes or segmentation faults in ImageMagick processes when handling JP2 files. Enable core dumps and examine stack traces; a heap overflow will typically show memory allocation errors or corruption warnings. If using a web application, log failed image uploads or processing errors and correlate them with JP2 MIME types. Intrusion detection systems can flag unusual process terminations linked to image file operations. Endpoint detection and response (EDR) tools may flag abnormal memory access patterns during ImageMagick execution. Review application logs for unexpected restarts of services dependent on ImageMagick.

Why prioritize this

This vulnerability warrants timely but not emergency patching. The CVSS 3.1 score of 5.5 (MEDIUM) reflects denial-of-service impact rather than critical code execution. However, organizations with public-facing image upload services or high-availability image processing pipelines should prioritize remediation within 30 days to avoid user-facing outages. Those in regulated industries or with strict image compliance requirements should patch sooner. The lack of KEV designation and confirmed in-the-wild exploitation lowers the threat urgency compared to critical or high-severity flaws, but the practical exploitability and common use of ImageMagick merit inclusion in regular patch cycles.

Risk score, explained

CVSS 3.1 score 5.5 reflects: (1) Local attack vector—attacker cannot reach the vulnerable code remotely; (2) Low attack complexity—no special conditions required; (3) No privileges required; (4) User interaction required—the file must be opened or processed; (5) No confidentiality or integrity impact—data is not exposed or tampered; (6) High availability impact—the process crashes. The 'R:U' (Scope Unchanged) indicates the impact is contained to the affected ImageMagick instance. The score lands in the MEDIUM band, appropriate for a localized denial-of-service flaw. Risk escalates if ImageMagick is publicly exposed or handles untrusted input at scale.

Frequently asked questions