ImageMagick Alert (CVE-2026-23876): “XBM” Image Uploads Trigger Massive Heap Overflow

ImageMagick has a high-severity flaw, CVE-2026-23876, where uploading a specially crafted XBM image can trigger a massive heap buffer overflow in the XBM decoder. The vulnerability, which carries a CVSS score of 8.1, arises from an integer truncation bug in the buffer size calculation that casts the image’s row count from 64-bit to 32-bit, leaving a large write loop to operate on a much bigger value than the allocated space.

According to vulnerability report, the issue occurs when image->rows is truncated for allocation while the write loop uses the original non-truncated value, allowing an attacker to write bytes past the heap boundary. The impact is broad because any web service processing untrusted images or backends used by content management systems—such as WordPress and Drupal—could be exposed, with the attack vector described as any application using ImageMagick to process untrusted images.

Patches have been released, and administrators are advised to upgrade to ImageMagick versions 7.1.2-13 or 6.9.13-38 to mitigate remote exploitation. The flaw is located in the XBM decoder (coders/xbm.c).