Volver a los avisos de seguridad

CVE-2026-116149 – ImageMagick vulnerability

CVE-2026-116149 is a high-severity (CVSS 8.1) stack buffer overflow (CWE-121) in ImageMagick when processing specially crafted bzip2-compressed images, affecting ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33. Raised on the DirectAdmin forum because servers using the PHP imagick extension are exposed through image uploads: update the ImageMagick system library (via your OS repository or CustomBuild once it ships the fixed build) and restart PHP so imagick reloads it.

High 8.1 CVSS
DirectAdmin

CMD de actualización por defecto

cd /usr/local/directadmin/custombuild && ./build update_versions

Lo que esto significa bajo una licencia de SharedLicense

Image processing libraries parse attacker-controlled uploads — a stack overflow there is a classic upload-to-RCE path for any site accepting images through imagick.

Hi All,

A new CVE-2026-116149, a high-severity stack buffer overflow in ImageMagick when processing specially crafted bzip2-compressed images.

Affected versions:

  • ImageMagick before 6.9.13-58
  • ImageMagick 7.x before 7.1.2-33

This could potentially affect DirectAdmin servers using the PHP imagick extension.

Could the DirectAdmin team confirm whether this requires any action within CustomBuild or whether it will be resolved through the AlmaLinux/RHEL packages?

References:

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pwpf-8799-94cj

https://www.cve.org/CVERecord?id=CVE-2026-116149

Preguntas frecuentes

What is CVE-2026-116149?
It is a high-severity stack buffer overflow (CWE-121, CVSS 8.1) in ImageMagick triggered by crafted bzip2-compressed images. Affected versions: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33. The DirectAdmin forum thread flags that PHP sites using the imagick extension process exactly these uploads.
Which versions fix CVE-2026-116149?
ImageMagick 6.9.13-58 (legacy 6 branch) and 7.1.2-33 (7 branch). Because imagick links against the system ImageMagick library, the fix arrives through your OS package update or panel tooling — not through upgrading the PHP extension alone.
How do I fix it on a DirectAdmin server?
Update the OS ImageMagick package (dnf update ImageMagick / apt upgrade), and check whether CustomBuild has shipped a matched build — then restart PHP-FPM/Apache so PHP's imagick extension reloads the patched library. Verify with php -r "phpinfo();" or identify -version showing the fixed ImageMagick build.
Is CVE-2026-116149 being exploited?
No exploitation is confirmed in the available data. Image-upload parsing flaws are nonetheless a standard attack surface — every site accepting image uploads through imagick should treat the library update as priority maintenance.

Referencias

Avisos de seguridad

Avisos relacionados

DirectAdmin CVE-2026-114718: Cross-Site Scripting (XSS)

2026-10-22 00:00:00

Bind CVE-2026-94300

2026-10-22

Roundcube 1.7.5 / 1.6.20 security updates

2026-10-19

Comprueba tu sistema en busca de vulnerabilidades

Selecciona tu producto y sistema operativo para ver los comandos de corrección exactos que se aplican a ti.

Comprueba tu sistema