PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45358 ImageMagick CVE debrief

CVE-2026-45358 is a medium-severity vulnerability in ImageMagick, a free and open-source software for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, an off-by-one error in the meta encoder could result in an out-of-bounds read of a single byte. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.

Vendor
ImageMagick
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-10
Original CVE updated
2026-06-11
Advisory published
2026-06-10
Advisory updated
2026-06-11

Who should care

Users of ImageMagick, particularly those who process untrusted images, should update to versions 6.9.13-47 or 7.1.2-22 to mitigate this vulnerability.

Technical summary

The vulnerability is caused by an off-by-one error in the meta encoder, leading to an out-of-bounds read of a single byte. This could potentially lead to information disclosure.

Defensive priority

Medium

Recommended defensive actions

  • Update ImageMagick to version 6.9.13-47 or 7.1.2-22 or later.
  • Avoid processing untrusted images with vulnerable versions of ImageMagick.

Evidence notes

The CVE-2026-45358 vulnerability was patched in ImageMagick versions 6.9.13-47 and 7.1.2-22. For more information, see [ref-4](https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr6r-hmj8-pr7r).

Official resources

CVE-2026-45358 was published on [cvePublishedAt](https://www.cve.org/CVERecord?id=CVE-2026-45358) and last modified on [cveModifiedAt](https://nvd.nist.gov/vuln/detail/CVE-2026-45358).