PatchSiren cyber security CVE debrief
CVE-2026-48994 ImageMagick CVE debrief
CVE-2026-48994 is a MEDIUM severity vulnerability in ImageMagick, a free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check of a return value could lead to a heap buffer over-write in the MAT decoder on 32-bit systems. This issue has been patched in versions 6.9.13-48 and 7.1.2-24.
- Vendor
- ImageMagick
- Product
- Unknown
- CVSS
- MEDIUM 5.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-10
- Original CVE updated
- 2026-06-11
- Advisory published
- 2026-06-10
- Advisory updated
- 2026-06-11
Who should care
Users of ImageMagick, especially those using versions prior to 6.9.13-48 and 7.1.2-24, should be aware of this vulnerability and take steps to update their installations.
Technical summary
The vulnerability is caused by a missing check of a return value in the MAT decoder, which could lead to a heap buffer over-write on 32-bit systems. The CVSS score for this vulnerability is 5.9, with a severity rating of MEDIUM.
Defensive priority
MEDIUM
Recommended defensive actions
- Update ImageMagick to version 6.9.13-48 or 7.1.2-24 or later.
- Review and apply patches as described in [ref-4](https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4v89-6mgq-6rgc).
Evidence notes
The CVE record [cve-org] and NVD detail [nvd] provide additional information about this vulnerability.
Official resources
-
CVE-2026-48994 CVE record
CVE.org
-
CVE-2026-48994 NVD detail
NVD
-
Source item URL
nvd_modified
-
Mitigation or vendor reference
[email protected] - Vendor Advisory
CVE-2026-48994 was published on [cvePublishedAt] and last modified on [cveModifiedAt].