PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46523 ImageMagick CVE debrief

CVE-2026-46523 is a medium-severity vulnerability in ImageMagick, a free and open-source software for editing and manipulating digital images. The vulnerability is caused by a crafted MSL image that can trigger a heap-use-after-free. This issue was fixed in versions 7.1.2.23 and 6.9.13-48.

Vendor
ImageMagick
Product
Unknown
CVSS
MEDIUM 6.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-10
Original CVE updated
2026-06-11
Advisory published
2026-06-10
Advisory updated
2026-06-11

Who should care

Users of ImageMagick, especially those who process MSL images, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The vulnerability has a CVSS score of 6.2 and a CVSS severity of MEDIUM. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The weakness is CWE-416.

Defensive priority

MEDIUM

Recommended defensive actions

  • Upgrade to ImageMagick version 7.1.2.23 or 6.9.13-48 or later.
  • Be cautious when processing MSL images from untrusted sources.

Evidence notes

The vulnerability was published on [cve-org](https://www.cve.org/CVERecord?id=CVE-2026-46523) and has a detailed record on [nvd](https://nvd.nist.gov/vuln/detail/CVE-2026-46523). The vendor advisory can be found at [ref-4](https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5r4x-w6p5-222q).

Official resources

CVE-2026-46523 was published on 2026-06-10T22:16:59.480Z and modified on 2026-06-11T18:42:06.253Z.