Junglewise Threat Intelligence

CVE-2026-23876: ImageMagick heap buffer overflow in XBM image decoder

CVE-2026-23876 · Severity: high · CVSS 8.1 · Published 2026-01-20

Technologies: Red Hat Enterprise Linux 6, ImageMagick. Vendors: Red Hat, ImageMagick.

Executive brief

ImageMagick, a widely used tool for processing and editing digital images, contains a security vulnerability that could allow an attacker to take control of a system. By uploading a specially crafted image file to a website or service that uses ImageMagick for processing (such as generating thumbnails or resizing uploads), an attacker can trigger a memory error. This could lead to unauthorized data access, service crashes, or the execution of malicious code on the server.

Technical details

A heap-based buffer overflow exists in the XBM image decoder (ReadXBMImage) of ImageMagick due to integer truncation. When calculating the buffer size for an image, the 'image->rows' value (size_t) is truncated to an unsigned int during allocation, but the subsequent write loop uses the original large value. This allows an attacker to provide a crafted XBM file with specific dimensions that trigger an out-of-bounds write of controlled data. The vulnerability is reachable via any operation that reads or identifies an image, such as through common web upload pipelines. Patches are available in versions 7.1.2-13 and 6.9.13-38.

Affected products

  • ImageMagick ImageMagick < 7.1.2-13, < 6.9.13-38
  • Red Hat Enterprise Linux Server (v. 7 ELS) 7
  • Red Hat Enterprise Linux 6 6

Timeline

  • 2026-01-19: advisory: GitHub Security Advisory published
  • 2026-01-20: disclosed: CVE published to NVD
  • 2026-02-23: patched: Red Hat released security updates (RHSA-2026:3058)

References

Related threats