PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48734 ImageMagick CVE debrief

CVE-2026-48734 is a stack overflow vulnerability in ImageMagick, a free and open-source software for editing and manipulating digital images. Prior to versions 6.9.13-49 and 7.1.2-24, a crafted MVG file could result in a stack overflow due to a missing depth or visited-set check. This issue has been patched in versions 6.9.13-49 and 7.1.2-24.

Vendor
ImageMagick
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-10
Original CVE updated
2026-06-11
Advisory published
2026-06-10
Advisory updated
2026-06-11

Who should care

Users of ImageMagick, particularly those who process MVG files, should be aware of this vulnerability and take steps to update to a patched version.

Technical summary

The vulnerability is caused by a missing depth or visited-set check when processing MVG files. This can lead to a stack overflow, potentially allowing an attacker to execute arbitrary code.

Defensive priority

MEDIUM

Recommended defensive actions

  • Update to ImageMagick version 6.9.13-49 or 7.1.2-24 or later.
  • Be cautious when processing MVG files from untrusted sources.

Evidence notes

CVE-2026-48734 has a CVSS score of 5.5 and is considered MEDIUM severity. The vulnerability was published on 2026-06-10T23:16:49.220Z and modified on 2026-06-11T18:44:38.903Z.

Official resources

CVE-2026-48734 was published on 2026-06-10T23:16:49.220Z and modified on 2026-06-11T18:44:38.903Z.