PatchSiren cyber security CVE debrief

CVE-2026-46521 ImageMagick CVE debrief

CVE-2026-46521 is a medium-severity vulnerability in ImageMagick, a free and open-source software for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compression in the MIFF encoder, an out-of-bounds write can occur due to a missing check. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

Vendor: ImageMagick
Product: Unknown
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-10
Original CVE updated: 2026-06-11
Advisory published: 2026-06-10
Advisory updated: 2026-06-11

Who should care

Users of ImageMagick, particularly those using versions prior to 6.9.13-48 and 7.1.2-23, should be aware of this vulnerability and take steps to update to a patched version.

Technical summary

The vulnerability is caused by a missing check when using LZMA compression in the MIFF encoder, which can lead to an out-of-bounds write. This issue has been assigned a CVSS score of 5.5 and a severity of MEDIUM.

Defensive priority

MEDIUM

Recommended defensive actions

Update to ImageMagick version 6.9.13-48 or later
Update to ImageMagick version 7.1.2-23 or later

Evidence notes

The vulnerability was patched in versions 6.9.13-48 and 7.1.2-23.

Sources and references

Verified primary and authoritative sources

CVE-2026-46521 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-46521

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-46521 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46521

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Mitigation or vendor reference
Unverified legacy reference

URL: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jcqp-6r6f-3mfx

[email protected] - Vendor Advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.