CVE-2026-105826: 
ImageMagick Análisis y mitigación de vulnerabilidades

CVE-2026-105826 is a security policy bypass vulnerability in ImageMagick's MAT decoder that enables a denial-of-service attack via disk resource exhaustion. The MAT decoder fails to enforce configured temporary file size limits when processing highly compressed data, allowing attackers to cause decompressed output to be written to temporary files far exceeding policy-defined limits. Affected versions include ImageMagick before 6.9.13-55 (6.x branch) and before 7.1.2-30 (7.x branch). It was published on October 8, 2026, with a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, ImageMagick Advisory).

The root cause is classified as CWE-409 (Improper Handling of Highly Compressed Data / Data Amplification): the MAT decoder does not check or enforce the configured disk resource limit in ImageMagick's security policy when decompressing MAT image data (ImageMagick Advisory). An attacker crafts a MAT image with a very high compression ratio such that the decompressed output vastly exceeds the allowed temporary file size, a classic "zip bomb" style attack applied to image processing. Exploitation requires no authentication, no user interaction, and no special privileges — only the ability to supply a crafted MAT file to an ImageMagick-processing endpoint (GitHub Advisory). The vulnerability was reported by researcher gb1dev (ImageMagick Advisory).

Successful exploitation results in disk space exhaustion on the host running ImageMagick, degrading or halting system availability — a denial-of-service condition. There is no impact to confidentiality or data integrity; the attack is limited to availability (CVSS availability impact: Low). Systems that process untrusted MAT image files — such as web applications, image conversion services, or content management platforms using ImageMagick — are most at risk, and repeated attacks could render the service or host inoperable (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The vulnerability is rated as automatable (no user interaction or authentication required), making it straightforward to exploit at scale against exposed services. The EPSS score is 0.0, reflecting low current exploitation probability, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory). No threat actor attribution has been reported.

1. Reconnaissance: Identify services or web applications that accept image uploads and process them with ImageMagick (e.g., profile picture uploads, document converters). Confirm the target is running a vulnerable version (ImageMagick < 6.9.13-55 or 7.x < 7.1.2-30).
2. Craft malicious MAT file: Create a MAT (MATLAB) image file containing highly compressed data with an extreme compression ratio, such that the decompressed payload is many times larger than the configured ImageMagick disk resource limit.
3. Submit the crafted file: Upload or send the crafted MAT file to the target service, triggering ImageMagick's MAT decoder to process it.
4. Trigger policy bypass: The MAT decoder decompresses the data and writes it to temporary files without enforcing the configured size limit, causing temporary disk space to be consumed far beyond the policy threshold.
5. Achieve denial of service: Repeated submissions exhaust available disk space on the target host, causing ImageMagick processing to fail and potentially crashing dependent services or the host itself (ImageMagick Advisory, GitHub Advisory).

• File System: Rapid growth of temporary files in ImageMagick's configured temporary directory (e.g., /tmp or the path set by MAGICK_TMPDIR); presence of large, unexpectedly sized temporary files with ImageMagick naming patterns (e.g., magick-*).
• Logs: ImageMagick error logs or application logs showing repeated MAT file processing requests; disk quota or filesystem full errors in system logs (/var/log/syslog, /var/log/messages) coinciding with image processing activity.
• Network: Repeated upload requests containing .mat file extensions or application/octet-stream content types to image-processing endpoints from the same or rotating source IPs.
• System Metrics: Sudden spikes in disk utilization on the partition hosting the temporary directory; alerts from disk monitoring tools indicating near-full or full filesystem conditions.

Update ImageMagick to version 6.9.13-55 or 7.1.2-30 (or later), which enforce temporary file size limits correctly in the MAT decoder (ImageMagick Advisory). As interim mitigations: disable the MAT decoder in ImageMagick's policy.xml if MAT file processing is not required (e.g., <policy domain="coder" rights="none" pattern="MAT" />); implement input validation to reject MAT files from untrusted sources before they reach ImageMagick; set filesystem quotas on the temporary directory to limit the blast radius of disk exhaustion; and restrict network access to ImageMagick processing services where possible (GitHub Advisory).

The vulnerability was assigned moderate severity by both the ImageMagick project and GitHub Advisory Database, with the fix credited to reporter gb1dev (ImageMagick Advisory). Red Hat opened a tracking bug (Bugzilla #2547995) and classified it as medium priority/severity for their products (Red Hat Bugzilla). No significant broader media coverage or notable researcher commentary beyond the initial advisory has been observed at this time.