PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46521 ImageMagick CVE debrief

CVE-2026-46521 is a medium-severity vulnerability in ImageMagick, a free and open-source software for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compression in the MIFF encoder, an out-of-bounds write can occur due to a missing check. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

Vendor
ImageMagick
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-10
Original CVE updated
2026-06-11
Advisory published
2026-06-10
Advisory updated
2026-06-11

Who should care

Users of ImageMagick, particularly those using versions prior to 6.9.13-48 and 7.1.2-23, should be aware of this vulnerability and take steps to update to a patched version.

Technical summary

The vulnerability is caused by a missing check when using LZMA compression in the MIFF encoder, which can lead to an out-of-bounds write. This issue has been assigned a CVSS score of 5.5 and a severity of MEDIUM.

Defensive priority

MEDIUM

Recommended defensive actions

  • Update to ImageMagick version 6.9.13-48 or later
  • Update to ImageMagick version 7.1.2-23 or later

Evidence notes

The vulnerability was patched in versions 6.9.13-48 and 7.1.2-23.

Official resources

CVE-2026-46521 was published on 2026-06-10T23:16:46.833Z and modified on 2026-06-11T18:42:09.680Z.