Quick answers
- Is CVE-2026-45031 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-45031 being exploited in the wild.
- How severe is CVE-2026-45031?
- Medium severity, with a CVSS score of 5.3, published 10 June 2026.
- Which products and versions are affected?
- Magick.NET-Q16-AnyCPU (NuGet) < 14.13.1; Magick.NET-Q16-arm64 (NuGet) < 14.13.1; Magick.NET-Q16-HDRI-AnyCPU (NuGet) < 14.13.1; Magick.NET-Q16-HDRI-arm64 (NuGet) < 14.13.1; and 14 more.
- Is there a fix for CVE-2026-45031?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-45031 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-45031?
- Check whether you run Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A resource policy bypass exists in ImageMagick's PSD decoder due to a missing check against the 'list-length' resource policy. By providing a specially crafted PSD image, a remote attacker can bypass intended restrictions on the number of elements processed, leading to uncontrolled resource consumption (CWE-400/CWE-770). While other security limits remain in place, this flaw can impact availability by exhausting system resources during image decoding. The issue is fixed in versions 6.9.13-47 and 7.1.2-22.
Affected products
- ImageMagick ImageMagick < 6.9.13-47, < 7.1.2-22
Identifiers
- CVE-2026-45031
- GHSA-cwpj-h54c-xjpx
Timeline
- 2026-05-16: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: NVD publication date