CVE-2026-105826: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-105826 is a security policy bypass vulnerability in the ImageMagick MAT decoder that enables unauthenticated remote attackers to cause a denial of service via disk exhaustion. The MAT decoder fails to enforce configured temporary file size limits when processing highly compressed data, allowing crafted images to write decompressed data to temporary files far exceeding policy-defined limits. It affects ImageMagick versions before 6.9.13-55 and 7.x before 7.1.2-30. The CVE has been marked as Rejected (duplicate) by the CVE program, with the canonical advisory being GHSA-3j4w-pvxj-fpjc (associated with CVE-2026-107210). The CVSS v3.1 base score is 5.3 (Medium) and the CVSS v4.0 base score is 6.9 (Medium) (GitHub Advisory, ImageMagick Advisory).

The root cause is classified as CWE-409 (Improper Handling of Highly Compressed Data / Data Amplification): the MAT decoder in ImageMagick does not check or enforce the disk resource limit defined in the ImageMagick security policy (policy.xml) before writing decompressed data to temporary files (ImageMagick Advisory). An attacker exploits this by supplying a specially crafted MAT image file with a very high compression ratio; when ImageMagick processes the file, the decompressed output written to the temporary directory can be orders of magnitude larger than the configured limit. No authentication, privileges, or user interaction are required — the attack is fully network-exploitable wherever ImageMagick processes user-supplied images (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in a denial of service through disk space exhaustion on the host running ImageMagick. An unauthenticated attacker can repeatedly submit crafted MAT images to cause temporary file directories to fill up, potentially disrupting other services and processes that depend on available disk space. There is no impact on confidentiality or data integrity; the vulnerability is limited to availability (GitHub Advisory, ImageMagick Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.333% (24th percentile), indicating a low near-term exploitation probability. The attack is automatable and requires no authentication, which lowers the barrier for exploitation if a PoC were to emerge (GitHub Advisory).

1. Identify target: Locate a service or application that accepts user-supplied image files and processes them with a vulnerable version of ImageMagick (before 6.9.13-55 or 7.x before 7.1.2-30).
2. Craft malicious MAT file: Create a MAT (MATLAB) image file containing highly compressed data with an extreme compression ratio, such that decompression produces output many times larger than the input (a "zip bomb" style payload in MAT format).
3. Submit the file: Upload or send the crafted MAT file to the target application (e.g., via a web form, API endpoint, or any interface that triggers ImageMagick processing).
4. Trigger decompression: ImageMagick's MAT decoder processes the file, decompressing the data and writing it to the system's temporary file directory without enforcing the configured disk resource limit in policy.xml.
5. Exhaust disk space: Repeated submissions (or a single sufficiently large payload) fill the temporary directory partition, causing disk exhaustion and degrading or crashing dependent services (ImageMagick Advisory, GitHub Advisory).

• File System: Rapid growth of files in the system temporary directory (e.g., /tmp, /var/tmp) with names matching ImageMagick's temporary file naming pattern (e.g., magick-*); disk usage on the partition hosting the temp directory approaching or reaching 100%.
• Logs: Application or web server logs showing repeated uploads or submissions of .mat files from the same or rotating source IPs; ImageMagick error messages in application logs referencing MAT decoder or temporary file operations.
• Process: convert, magick, or related ImageMagick processes with unusually high disk I/O or long runtimes associated with MAT file processing.
• Network: Repeated inbound requests submitting MAT-format image files, particularly from a single source or a small set of IPs in a short time window.

Update ImageMagick to version 6.9.13-55 or 7.1.2-30 or later, which enforce temporary file size limits correctly in the MAT decoder (ImageMagick Advisory). As interim workarounds: disable the MAT decoder in policy.xml if MAT image processing is not required (e.g., <policy domain="coder" rights="none" pattern="MAT" />); implement input validation to reject MAT files before they reach ImageMagick; set filesystem quotas on the temporary directory to limit the blast radius of disk exhaustion; and restrict network access to ImageMagick-processing services where feasible (GitHub Advisory).

The vulnerability was reported by researcher gb1dev and published by ImageMagick maintainer dlemstra via GitHub Security Advisories (ImageMagick Advisory). Red Hat opened a tracking bug (Bugzilla #2547995) and is assessing impact on its products (Red Hat Bugzilla). No significant broader media coverage or notable social media discussion has been observed for this moderate-severity denial-of-service issue.