PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46559 ImageMagick CVE debrief

CVE-2026-46559 is a medium-severity vulnerability in ImageMagick, a free and open-source software for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an incorrect check in the JP2 will result in an heap buffer over-write of a single byte when specifying certain options. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

Vendor
ImageMagick
Product
Unknown
CVSS
MEDIUM 4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-10
Original CVE updated
2026-06-11
Advisory published
2026-06-10
Advisory updated
2026-06-11

Who should care

Users of ImageMagick versions prior to 6.9.13-48 and 7.1.2-23 should apply the patches to prevent exploitation of this vulnerability.

Technical summary

The vulnerability is caused by an incorrect check in the JP2, which can lead to a heap buffer over-write of a single byte. This can be exploited by specifying certain options.

Defensive priority

Medium

Recommended defensive actions

  • Apply patches: Upgrade to ImageMagick versions 6.9.13-48 or 7.1.2-23 or later.
  • Review and update: Review your systems and update to the patched versions.

Evidence notes

CVE-2026-46559 has a CVSS score of 4 and a severity of MEDIUM. The vulnerability was published on 2026-06-10T23:16:47.173Z and modified on 2026-06-11T18:42:17.210Z.

Official resources

CVE-2026-46559 was published on 2026-06-10T23:16:47.173Z and modified on 2026-06-11T18:42:17.210Z.