CVE-2026-53467: Heap Information Disclosure via Uninitialized Pixel Cache in ImageMagick MNG Decoder

ImageMagick is an open-source suite designed for editing, composing, and converting raster images. The application utilizes a variety of format-specific coders to decode input images into an internal representation. One such component is the Multiple-image Network Graphics (MNG) decoder, implemented in coders/mng.c. MNG is an extension of the Portable Network Graphics (PNG) standard designed to support animations, incorporating complex multi-layered canvas layouts and individual image frames.

The MNG decoder contains a heap information disclosure vulnerability classified as a use of uninitialized resource (CWE-908 / CWE-200). The vulnerability is tracked as CVE-2026-53467, with an alternative identifier of GHSA-8g53-9m3c-69xg. The vulnerability is exposed to any application that accepts untrusted MNG images and processes them using vulnerable versions of ImageMagick.

This flaw allows remote, unauthenticated attackers to retrieve fragments of raw process memory from the hosting server's heap. This disclosure occurs because the decoder fails to guarantee that all allocated pixel channels are cleared or populated prior to file conversion and transmission. This analysis examines the technical breakdown of the uninitialized pixel cache, evaluates the code change implementing the patch, and details detection and mitigation strategies.

The underlying issue stems from how ImageMagick allocates and manages memory buffers representing the image canvas. During MNG parsing, the decoder allocates dynamic heap memory buffers to serve as a pixel cache. In versions prior to 6.9.13-51 and 7.1.2-26, the memory allocation routines did not perform zero-initialization on these pixel buffers.

An MNG file is characterized by nested sub-images and layered offsets. An attacker can construct a crafted MNG file that specifies large canvas dimensions (for instance, 1000 by 1000 pixels) while only supplying concrete pixel data for a very small bounding box (such as a 10 by 10 block). Alternatively, the file can exploit framing offsets or transparency masks to instruct the decoder to skip rendering sections of the canvas entirely.

Because the heap-allocated pixel cache is not fully initialized, regions of the canvas that are skipped or left unchanged retain the binary data previously stored in those memory blocks. ImageMagick's allocator leaves these blocks untouched, preserving residual bytes from previous heap allocations. These leftover bytes can include sensitive application data, execution state, or pointers.

The security patches for CVE-2026-53467 target the MNG decoder's version declaration and build configuration files, ensuring a version bump to formalize the release. The primary remediation strategy involves forcing the initialization of newly allocated pixel structures. In vulnerable codebases, initialization was skipped or deferred, creating conditions where rendering loops left memory unchanged.

The patch in ImageMagick v7 (38ba210c5e5a660013d632a3d33c431e658befcc) and ImageMagick v6 (c1e211d2b25a62f45692de857491f5054fc00f84) bumped the version boundaries to 7.1.2-26 and 6.9.13-51 respectively, integrating fixes to clear quantum memory before usage. The configuration changes demonstrate how release versions were advanced to push the safety mechanisms into production:

diff --git a/configure b/configure
-MAGICK_VERSION=7.1.2-25
-MAGICK_GIT_REVISION=6c64b5881:20260614
+MAGICK_VERSION=7.1.2-26
+MAGICK_GIT_REVISION=702175ac4:20260621
...
diff --git a/m4/version.m4 b/m4/version.m4
-m4_define([magick_patchlevel_version], [25])
+m4_define([magick_patchlevel_version], [26])

The code fix enforces that ResetQuantumMemory or equivalent background initialization is invoked immediately after allocation in coders/mng.c. This action forces the operating system or memory allocator to write zero bytes across the entire layout before parsing chunks. As a result, any coordinates skipped by sparse MNG definitions default to black or transparent pixels instead of raw heap leftovers.

Exploiting CVE-2026-53467 requires zero administrative privileges and can be executed entirely out-of-band. The primary prerequisite is that the target server utilizes a vulnerable version of ImageMagick to process, convert, or resize user-provided images. This scenario is common in web applications supporting profile photo uploads, media management, or document conversion services.

The attack sequence is structured as follows:

1. The attacker generates a sparse MNG file defining an extensive image canvas (e.g., 2048 by 2048 pixels).
2. The attacker defines a single minimal image chunk or omits writing data to most of the defined grid coordinates.
3. The MNG file is uploaded or submitted to the vulnerable application.
4. The application triggers ImageMagick to parse the file and convert it into a standard web-safe format, such as PNG or JPEG.
5. The converted image is returned or rendered on a public-facing interface.

Once the output image is retrieved, the attacker parses the raw pixel color channels of the unaltered regions. Because these coordinates were filled with uninitialized heap bytes during allocation, the pixel values directly map to the binary contents of the server's heap. The attacker decodes these visual artifacts back into raw hexadecimal or ASCII representations to extract sensitive data.

The severity of CVE-2026-53467 is rated at CVSS 5.3 (Medium). The confidentiality impact is classified as low because the attacker cannot choose the specific location of the heap to read. Instead, they are restricted to reading whatever data happens to reside in the memory addresses allocated by the operating system at that moment.

Despite the low confidentiality impact classification, the practical risk in multi-tenant or software-as-a-service (SaaS) environments can be elevated. The allocated heap space may contain sensitive data processed by other concurrent threads, including database connection strings, active session tokens, and unencrypted user input processed shortly before the exploit.

Additionally, the leaked heap bytes can expose raw memory addresses. This leak can compromise Address Space Layout Randomization (ASLR) protections, allowing adversaries to map the memory space of the target process and construct chained exploits leading to remote code execution.

The primary remediation path is upgrading ImageMagick to patched versions. For deployments utilizing the modern v7 branch, update to version 7.1.2-26 or newer. For organizations maintaining legacy v6 structures, migrate to version 6.9.13-51 or newer. This ensures the integration of the mandatory initialization logic within the MNG decoder.

If an immediate upgrade is unfeasible, administrators can mitigate the risk by modifying the ImageMagick global security policy to disable processing of vulnerable image formats entirely. This is achieved by editing the policy.xml configuration file, typically located within /etc/ImageMagick-7/policy.xml or /etc/ImageMagick-6/policy.xml.

Add the following security policies to deny execution rights to the MNG and JNG coders:

<policymap>
  <policy domain="coder" rights="none" pattern="MNG" />
  <policy domain="coder" rights="none" pattern="JNG" />
</policymap>

These declarations instruct the parser to reject these formats at the entry boundary. This approach eliminates the attack surface without requiring a complete library rebuild or system reboot.