Patch ImageMagick now: five security fixes for image-processing pipelines

Summary

Publication date: 25 October 2026 for all five CVE records. This is not a claim that active exploitation has been observed.

What is confirmed

ImageMagick is commonly invoked by web applications, CMS platforms, upload pipelines and document-conversion workers. The relevant boundary is not whether the command exists on a host, but whether an untrusted party can cause that exact installed binary to decode an image, PDF, PS, XPS, UHDR or MVG input.

The vendor advisories and NVD records describe five defects fixed in the current releases:

• CVE-2026-116140: a delegate-invocation parsing error can bypass a policy.xml executable block when processing input that triggers a delegate.
• CVE-2026-116141: UHDR extent limits are applied after decoding, permitting excessive resource consumption.
• CVE-2026-116142: minimum-bounding-box output can read beyond an allocated heap buffer, causing a crash or possible adjacent-memory disclosure.
• CVE-2026-116143: PS, PDF and XPS decoder scene-selection limits can be bypassed, potentially consuming excessive resources.
• CVE-2026-116144: recursive MVG processing can exhaust stack space and crash the process.

Not confirmed: public exploitation, CISA KEV inclusion, or impact on every application that has ImageMagick installed. Do not test by feeding crafted files to production.

Are you affected?

On each owned server, container image or build worker that processes content, record the active binary and version:

command -v magick || command -v convert
magick -version 2>/dev/null || convert -version

Expected result: a binary path and ImageMagick version. A 6.x build below 6.9.13-58 is in scope for CVE-2026-116140, -116143 and -116144. A 7.x build below 7.1.2-33 is in scope for all five. Package naming alone is insufficient: distribution backports may carry fixes under a different package version, so check the distribution security advisory before declaring a backported build safe.

Find application calls without sending a test file:

systemctl list-unit-files | grep -Ei 'image|convert|media|upload'
grep -R --line-number --include='*.conf' --include='*.yml' --include='*.yaml' 'magick\|convert' /etc 2>/dev/null

Expected result: candidate services and configuration references. A match shows a possible integration, not confirmed exposure. Inspect the service account, upload path, queued jobs and container image to determine whether untrusted content reaches ImageMagick.

NetTools.tech — HTTP Headers: enter the URL of an upload or image-processing service you own. A reachable response confirms only that the endpoint is publicly reachable; it does not reveal ImageMagick, the installed version or CVE exposure. Do not scan systems without authorisation.

Patch through the supported package or image path

Prerequisites

1. Open an approved change and identify the application owner, runtime image/package source and maintenance window.
2. Preserve the current version output, service health and a known-good sample conversion result.
3. Confirm whether the operating-system vendor has published a backported fix; follow that vendor's supported update channel rather than compiling an ad-hoc replacement.

Steps

1. Update the relevant ImageMagick package or base image using the platform's approved repository or image pipeline.
2. For a container workload, rebuild from the updated base image, record its digest, deploy it through the normal rollout and restart only the named workload.
3. For a package-managed Linux host, use the organisation's approved package command, then restart the owning service during its maintenance window. Do not restart an unknown service merely because ImageMagick is installed.
4. Re-run the version command from the same execution environment as the workload.

Expected result: the workload uses ImageMagick 6.9.13-58 or later, or 7.1.2-33 or later, unless the platform vendor documents an equivalent backport.

Validate

Run a normal, non-malicious conversion using an approved internal sample and check the application health endpoint or queue. Then record:

magick -version 2>/dev/null || convert -version

A successful conversion proves basic service continuity; the recorded version or vendor-backport advisory is the remediation evidence. Review error logs for delegate, policy or decoder failures after the rollout.

Containment while change is pending

The reviewed advisories do not provide a separate vendor configuration workaround that replaces patching. Do not invent one. Until the supported update is deployed:

• restrict upload and conversion access to necessary authenticated users;
• keep conversion workers isolated from secrets and production-management networks;
• enforce file size, page/count and job-resource limits at the application or queue layer;
• preserve existing ImageMagick policy.xml restrictions, but do not treat them as a fix for CVE-2026-116140 or -116143.

These measures reduce blast radius only.

Rollback

If the updated package or image causes a verified application failure, use the tested release rollback procedure and restore the prior service version. Record that rollback may restore a vulnerable ImageMagick build; retain access restrictions and schedule a vendor-supported replacement. Never silently downgrade a shared host package without checking dependent applications.

Evidence and interpretation

The five GitHub Security Advisories are the primary evidence for affected versions and fixed releases. NVD records independently provide publication timing and CVSS data. CISA KEV was checked on 26 October 2026 and does not list these CVEs; absence from KEV is not proof of safety.

Prioritise this work by exposure: an internal design workstation with no untrusted input has a different operational risk from a public upload service or SaaS document-conversion worker. The risk is driven by reachable content-processing paths and the available containment, not by the modest CVSS numbers alone.

Chronology

• 25 October 2026: NVD publishes CVE-2026-116140 through CVE-2026-116144.
• 26 October 2026: notmyfault.fail verifies the vendor advisories, NVD records and CISA KEV status.

References

1. ImageMagick GitHub Security Advisory: GHSA-528x-2384-jmxp
2. ImageMagick GitHub Security Advisory: GHSA-h3qx-937j-245g
3. ImageMagick GitHub Security Advisory: GHSA-5222-mhv9-26rg
4. ImageMagick GitHub Security Advisory: GHSA-fp46-842c-2v83
5. ImageMagick GitHub Security Advisory: GHSA-x258-xjqf-6j3f
6. NVD CVE records: CVE-2026-116140 through CVE-2026-116144
7. CISA Known Exploited Vulnerabilities Catalog

Change log

• 26 October 2026 — r1: Initial publication; source and exploitation-status check completed.