CVE-2026-53466: CVE-2026-53466: Integer Conversion Overflow in ImageMagick XCF Decoder

#security #cve #cybersecurity

CVE-2026-53466: Integer Conversion Overflow in ImageMagick XCF Decoder

Vulnerability ID: CVE-2026-53466
CVSS Score: 6.5
Published: 2026-07-31

An integer conversion overflow vulnerability exists in the XCF decoder of ImageMagick before version 6.9.13-51 and 7.1.2-26. The issue arises from mixed-type arithmetic that promotes calculation results to floating-point representations, causing an undefined cast back to integer. Under optimizing compilers, this undefined behavior results in bounds checks being bypassed, allowing out-of-bounds heap reads.

TL;DR

A floating-point promotion bug in the ImageMagick XCF decoder causes critical bounds checks to be optimized away by compilers, leading to heap out-of-bounds reads and potential denial of service or information leakage.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-190, CWE-681
Attack Vector: Network
CVSS: 6.5
EPSS: 0.0022
Impact: Denial of Service / Information Disclosure
Exploit Status: Theoretical / Patch Analysis
KEV Status: Not Listed

Affected Systems

ImageMagick implementations handling GIMP XCF files
Web applications using Magick.NET or local CLI wrappers to convert image uploads
Document and email indexing pipelines using ImageMagick for automatic file rendering
ImageMagick: < 6.9.13-51 (Fixed in: 6.9.13-51)
ImageMagick: >= 7.0.0-0, < 7.1.2-26 (Fixed in: 7.1.2-26)
Magick.NET: < 14.15.0 (Fixed in: 14.15.0)

Code Analysis

Commit: 47ca721

Fix integer conversion overflow in XCF decoder load_level function

@@ -753,7 +753,7 @@ static MagickBooleanType load_level(Image *image,XCFDocInfo *inDocInfo,
     /* if the offset is 0 then we need to read in the maximum possible
        allowing for negative compression */
     if (offset2 == 0)
-      offset2=(MagickOffsetType) (offset + TILE_WIDTH * TILE_WIDTH * 4* 1.5);
+      offset2=(MagickOffsetType) (offset+TILE_WIDTH*TILE_WIDTH*(3*4)/2);

Exploit Details

GitHub: Security advisory and analysis of the floating point promotion bypass in load_level

Mitigation Strategies

Upgrade ImageMagick system packages to non-vulnerable versions
Disable XCF parsing entirely via ImageMagick security policies
Compile ImageMagick with strict overflow compiler flags to preserve bounds checks

Remediation Steps:

Locate the system-wide policy.xml file (typically /etc/ImageMagick-7/policy.xml or /etc/ImageMagick-6/policy.xml).
Add the rule inside the tag block.
Save the configuration file and verify that XCF file processing is now rejected by running 'identify test.xcf'.

References

Read the full report for CVE-2026-53466 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community