Is CVE-2026-116149 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116149 being exploited in the wild.

How severe is CVE-2026-116149?

High severity, with a CVSS score of 8.1, published 25 October 2026.

Which products and versions are affected?

ImageMagick 6.x before 6.9.13-58; 7.x before 7.1.2-33.

Is there a fix for CVE-2026-116149?

Yes: fixed in ImageMagick 6.9.13-58, 7.1.2-33. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116149 attacked?

It is attacked over the network.

Am I affected by CVE-2026-116149?

Check whether you run ImageMagick at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116149: ImageMagick stack buffer overflow in bzip2 decompression

CVE-2026-116149 · Severity: high · CVSS 8.1 · Published 2026-10-25

ImageMagick is a widely used image processing library used by web applications, content management systems, and enterprise software. A crafted image file compressed with bzip2 can trigger a stack buffer overflow during decompression, allowing an attacker to corrupt memory and crash the application or potentially execute arbitrary code. An attacker needs only to trick a user or system into processing a malicious image file.

Technologies: ImageMagick. Vendors: ImageMagick.

Quick answers

Is CVE-2026-116149 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116149 being exploited in the wild.
How severe is CVE-2026-116149?: High severity, with a CVSS score of 8.1, published 25 October 2026.
Which products and versions are affected?: ImageMagick 6.x before 6.9.13-58; 7.x before 7.1.2-33.
Is there a fix for CVE-2026-116149?: Yes: fixed in ImageMagick 6.9.13-58, 7.1.2-33. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116149 attacked?: It is attacked over the network.
Am I affected by CVE-2026-116149?: Check whether you run ImageMagick at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: ImageMagick 6.9.13-58, 7.1.2-33

Technical details

A stack-based buffer overflow exists in ImageMagick's bzip2 image decompression handler. An attacker can supply a crafted bzip2-compressed image that writes past the bounds of a stack buffer during decoding, corrupting stack memory. The vulnerability requires low privileges and no user interaction beyond opening the image; exploitation requires network access and low privilege level to trigger. A fix is available in patched versions.

Affected products

ImageMagick ImageMagick 6.x before 6.9.13-58; 7.x before 7.1.2-33

Timeline

2026-10-10: disclosed
2026-10-25: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.