CVE-2026-46521
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile — higher than 2% of all known CVEs
Summary
ImageMagick prior to versions 6.9.13-48 and 7.1.2-23 contained a vulnerability that allowed for an out of bounds write when using LZMA compression in the MIFF encoder due to a missing check.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized memory access, potentially resulting in application crashes or the execution of malicious code.
Recommendation
It is recommended to upgrade to versions 6.9.13-48 or 7.1.2-23 to mitigate this vulnerability.
Original NVD description (English source)
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compression in the MIFF encoder an out of bounds write can occur due to a missing check. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.