Back to Security Advisories

CVE-2026-116149 – ImageMagick vulnerability

CVE-2026-116149 is a high-severity (CVSS 8.1) stack buffer overflow (CWE-121) in ImageMagick when processing specially crafted bzip2-compressed images, affecting ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33. Raised on the DirectAdmin forum because servers using the PHP imagick extension are exposed through image uploads: update the ImageMagick system library (via your OS repository or CustomBuild once it ships the fixed build) and restart PHP so imagick reloads it.

High 8.1 CVSS
DirectAdmin

Default Update CMD

cd /usr/local/directadmin/custombuild && ./build update_versions

What this means under a SharedLicense license

Image processing libraries parse attacker-controlled uploads — a stack overflow there is a classic upload-to-RCE path for any site accepting images through imagick.

Hi All,

A new CVE-2026-116149, a high-severity stack buffer overflow in ImageMagick when processing specially crafted bzip2-compressed images.

Affected versions:

  • ImageMagick before 6.9.13-58
  • ImageMagick 7.x before 7.1.2-33

This could potentially affect DirectAdmin servers using the PHP imagick extension.

Could the DirectAdmin team confirm whether this requires any action within CustomBuild or whether it will be resolved through the AlmaLinux/RHEL packages?

References:

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pwpf-8799-94cj

https://www.cve.org/CVERecord?id=CVE-2026-116149

Frequently Asked Questions

What is CVE-2026-116149?
It is a high-severity stack buffer overflow (CWE-121, CVSS 8.1) in ImageMagick triggered by crafted bzip2-compressed images. Affected versions: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33. The DirectAdmin forum thread flags that PHP sites using the imagick extension process exactly these uploads.
Which versions fix CVE-2026-116149?
ImageMagick 6.9.13-58 (legacy 6 branch) and 7.1.2-33 (7 branch). Because imagick links against the system ImageMagick library, the fix arrives through your OS package update or panel tooling — not through upgrading the PHP extension alone.
How do I fix it on a DirectAdmin server?
Update the OS ImageMagick package (dnf update ImageMagick / apt upgrade), and check whether CustomBuild has shipped a matched build — then restart PHP-FPM/Apache so PHP's imagick extension reloads the patched library. Verify with php -r "phpinfo();" or identify -version showing the fixed ImageMagick build.
Is CVE-2026-116149 being exploited?
No exploitation is confirmed in the available data. Image-upload parsing flaws are nonetheless a standard attack surface — every site accepting image uploads through imagick should treat the library update as priority maintenance.

References

Security Advisories

Related Advisories

DirectAdmin CVE-2026-114718: Cross-Site Scripting (XSS)

2026-10-22 00:00:00

Bind CVE-2026-94300

2026-10-22

Roundcube 1.7.5 / 1.6.20 security updates

2026-10-19

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System