CVE-2026-32259: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-32259 is a stack-based buffer overflow vulnerability in ImageMagick's sixel encoder, classified as Moderate severity. It affects all ImageMagick versions prior to 7.1.2-16 (in the 7.x branch) and prior to 6.9.13-41 (in the 6.x branch). The vulnerability was disclosed on March 12, 2026, by researcher Mcsky23 via a GitHub Security Advisory. It carries a CVSS v3.1 base score of 6.7 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a stack-based buffer overflow (CWE-121) in ImageMagick's sixel encoder component. When a memory allocation fails during sixel encoding, the error-handling path does not properly guard against writing past the end of a stack-allocated buffer, allowing out-of-bounds writes. Exploitation requires local access and involves high attack complexity, as the failure condition (memory allocation failure) must be triggered — for example, by processing a crafted image under constrained memory conditions. No public proof-of-concept exploit code has been identified at this time (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation can result in high integrity and availability impacts, with no confidentiality impact per the CVSS scoring. An attacker who triggers the overflow could corrupt stack memory, potentially leading to application crashes (denial of service) or, under favorable conditions, arbitrary code execution within the context of the ImageMagick process. The scope is unchanged, meaning impact is limited to the vulnerable component itself without privilege escalation to other system components (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-32259. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and high attack complexity, significantly limiting the practical attack surface (GitHub Advisory, Red Hat Bugzilla).

ImageMagick has released patched versions addressing this vulnerability: 7.1.2-16 for the 7.x branch and 6.9.13-41 for the 6.x branch. Users should upgrade to these versions or later as the primary remediation. Downstream Linux distributions including Debian, SUSE/openSUSE, and Amazon Linux 2 have also released updated packages. No configuration-based workaround has been published; upgrading is the recommended action (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by researcher Mcsky23 and published by ImageMagick maintainer dlemstra via a GitHub Security Advisory on March 12, 2026. Red Hat tracked the issue via Bugzilla and assessed it as medium priority/severity. Multiple Linux distributions (Debian, SUSE, openSUSE, Amazon Linux 2) issued security advisories and updated packages in the weeks following disclosure, reflecting standard patch propagation for a moderate-severity library vulnerability (GitHub Advisory, Red Hat Bugzilla).