Stack Buffer Overflow in ImageMagick bzip2 Image Handling

CVE-2026-116149 is a stack-based buffer overflow vulnerability in ImageMagick's bzip2 decompression routine that affects versions before 6.9.13-58 and 7.x before 7.1.2-33. When processing specially crafted bzip2-compressed images, the vulnerability allows attackers to overwrite stack memory during the decoding process, potentially leading to application crashes, denial of service, or memory corruption that could enable code execution. This affects any system using vulnerable ImageMagick versions to process untrusted image files, including web servers running image processing pipelines, content management systems, and security tools that analyze image files.

While this CVE currently maps to CWE-121 (stack-based buffer overflow) with no direct MITRE ATT&CK technique attribution, Casky's Claude-powered analysis would identify the underlying attack chain by detecting memory manipulation patterns and input validation bypass attempts. Practitioners using Casky would observe findings related to Improper Input Validation and Resource Manipulation, with detection logic focused on anomalous bzip2 decompression behaviors, memory boundary violations, and crash signatures. Although no matching security skills are currently mapped to this specific CVE in Casky's 754-skill MITRE ATT&CK framework, security teams would benefit from defensive skills covering Execution, Defense Evasion, and Impact techniques—enabling them to correlate suspicious image processing activities with potential exploitation attempts and implement compensating controls for vulnerable systems pending patching.