# CVE-2026-23876: ImageMagick heap buffer overflow in XBM image decoder

Source: https://junglewise.ai/threats/cve-2026-23876-imagemagick-heap-buffer-overflow-in-xbm-image-decoder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-20. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-23876 · Severity: high · CVSS 8.1 · Published 2026-01-20

ImageMagick, a widely used tool for processing and editing digital images, contains a security vulnerability that could allow an attacker to take control of a system. By uploading a specially crafted image file to a website or service that uses ImageMagick for processing (such as generating thumbnails or resizing uploads), an attacker can trigger a memory error. This could lead to unauthorized data access, service crashes, or the execution of malicious code on the server.

Technologies: [ImageMagick](https://junglewise.ai/threats/technologies/imagemagick). Vendors: [ImageMagick](https://junglewise.ai/threats/vendors/imagemagick).

## Quick answers

**Is CVE-2026-23876 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-23876 being exploited in the wild.

**How severe is CVE-2026-23876?** High severity, with a CVSS score of 8.1, published 20 January 2026.

**Which products and versions are affected?** ImageMagick < 7.1.2-13, < 6.9.13-38.

**Is there a fix for CVE-2026-23876?** A patch was published on 2026-02-23: Red Hat released security updates (RHSA-2026:3058) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-23876 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-23876?** Check whether you run ImageMagick at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow exists in the XBM image decoder (ReadXBMImage) of ImageMagick due to integer truncation. When calculating the buffer size for an image, the 'image->rows' value (size_t) is truncated to an unsigned int during allocation, but the subsequent write loop uses the original large value. This allows an attacker to provide a crafted XBM file with specific dimensions that trigger an out-of-bounds write of controlled data. The vulnerability is reachable via any operation that reads or identifies an image, such as through common web upload pipelines. Patches are available in versions 7.1.2-13 and 6.9.13-38.

## Affected products

- ImageMagick ImageMagick < 7.1.2-13, < 6.9.13-38
- Red Hat Enterprise Linux Server (v. 7 ELS) 7
- Red Hat Enterprise Linux 6 6

## Timeline

- 2026-01-19: advisory: GitHub Security Advisory published
- 2026-01-20: disclosed: CVE published to NVD
- 2026-02-23: patched: Red Hat released security updates (RHSA-2026:3058)

## References

- [https://github.com/ImageMagick/ImageMagick/commit/2fae24192b78fdfdd27d766fd21d90aeac6ea8b8](https://github.com/ImageMagick/ImageMagick/commit/2fae24192b78fdfdd27d766fd21d90aeac6ea8b8)
- [https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r49w-jqq3-3gx8](https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r49w-jqq3-3gx8)
- [https://access.redhat.com/errata/RHSA-2026:3058](https://access.redhat.com/errata/RHSA-2026:3058)
- [https://access.redhat.com/security/cve/CVE-2026-23876](https://access.redhat.com/security/cve/CVE-2026-23876)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2431038](https://bugzilla.redhat.com/show_bug.cgi?id=2431038)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23876.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23876.json)

## Related threats

- [ImageMagick infinite loop in SVG decoder](https://junglewise.ai/threats/cve-2026-123273-imagemagick-before-7-1-2-35-and-6-9-13-60-contains-an-infinite)
- [ImageMagick memory leak in XMP profile handling](https://junglewise.ai/threats/cve-2026-116155-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a)
- [ImageMagick memory leak in XML parsing depth limit](https://junglewise.ai/threats/cve-2026-116154-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a)
- [ImageMagick memory leak in MAT decoder](https://junglewise.ai/threats/cve-2026-116152-imagemagick-before-7-1-2-33-contains-a-memory-leak-vulnerability)
- [ImageMagick stack buffer overflow in bzip2 decompression](https://junglewise.ai/threats/cve-2026-116149-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a)