Just seen there's another high-severity attack stack buffer overflow CVE been reported in ImageMagick
Updated: 2026-10-25
Published: 2026-10-25
Title: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compressed Images
Description
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption.
Affected versions:
ImageMagick before 6.9.13-58
ImageMagick 7.x before 7.1.2-33
https://www.cve.org/CVERecord?id=CVE-2026-116149
Checked on my servers and it looks like it needs patching. Not sure if this is an Enhance fix, or Developer, via Ubuntu Repo. Can @Adam or @Aliysa_Enhance put out a patch or let us know how to install updates/patches on servers for us please? Would be very grateful 🙏
root@xxxx ~ # convert -version
Version: ImageMagick 6.9.12-98 Q16 x86_64 18038 https://legacy.imagemagick.org
Copyright: (C) 1999 ImageMagick Studio LLC
License: https://imagemagick.org/script/license.php
Features: Cipher DPC Modules OpenMP(4.5)
Delegates (built-in): bzlib djvu fftw fontconfig freetype heic jbig jng jp2 jpeg lcms lqr ltdl lzma openexr pangocairo png raw tiff webp wmf x xml zlib
