# CVE-2026-116149: ImageMagick stack buffer overflow in bzip2 decompression

Source: https://junglewise.ai/threats/cve-2026-116149-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-25. Updated: 2026-10-25  
License: CC BY 4.0 with a link back

CVE-2026-116149 · Severity: high · CVSS 8.1 · Published 2026-10-25

ImageMagick is a widely used image processing library used by web applications, content management systems, and enterprise software. A crafted image file compressed with bzip2 can trigger a stack buffer overflow during decompression, allowing an attacker to corrupt memory and crash the application or potentially execute arbitrary code. An attacker needs only to trick a user or system into processing a malicious image file.

Technologies: [ImageMagick](https://junglewise.ai/threats/technologies/imagemagick). Vendors: [ImageMagick](https://junglewise.ai/threats/vendors/imagemagick).

## Quick answers

**Is CVE-2026-116149 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116149 being exploited in the wild.

**How severe is CVE-2026-116149?** High severity, with a CVSS score of 8.1, published 25 October 2026.

**Which products and versions are affected?** ImageMagick 6.x before 6.9.13-58; 7.x before 7.1.2-33.

**Is there a fix for CVE-2026-116149?** Yes: fixed in ImageMagick 6.9.13-58, 7.1.2-33. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116149 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-116149?** Check whether you run ImageMagick at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in ImageMagick 6.9.13-58, 7.1.2-33

## Technical details

A stack-based buffer overflow exists in ImageMagick's bzip2 image decompression handler. An attacker can supply a crafted bzip2-compressed image that writes past the bounds of a stack buffer during decoding, corrupting stack memory. The vulnerability requires low privileges and no user interaction beyond opening the image; exploitation requires network access and low privilege level to trigger. A fix is available in patched versions.

## Affected products

- ImageMagick ImageMagick 6.x before 6.9.13-58; 7.x before 7.1.2-33

## Timeline

- 2026-10-10: disclosed
- 2026-10-25: advisory

## References

- [https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pwpf-8799-94cj](https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pwpf-8799-94cj)
- [https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-stack-buffer-overflow-via-bzip2-compressed-images](https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-stack-buffer-overflow-via-bzip2-compressed-images)

## Related threats

- [ImageMagick infinite loop in SVG decoder](https://junglewise.ai/threats/cve-2026-123273-imagemagick-before-7-1-2-35-and-6-9-13-60-contains-an-infinite)
- [ImageMagick memory leak in XMP profile handling](https://junglewise.ai/threats/cve-2026-116155-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a)
- [ImageMagick memory leak in XML parsing depth limit](https://junglewise.ai/threats/cve-2026-116154-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a)
- [ImageMagick memory leak in MAT decoder](https://junglewise.ai/threats/cve-2026-116152-imagemagick-before-7-1-2-33-contains-a-memory-leak-vulnerability)
- [ImageMagick policy bypass in UHDR decoder](https://junglewise.ai/threats/cve-2026-116141-imagemagick-before-7-1-2-33-contains-a-policy-bypass)