Junglewise Threat Intelligence

CVE-2026-45358: ImageMagick off-by-one error in meta encoder

CVE-2026-45358 · Severity: medium · CVSS 5.3 · Published 2026-06-10

Technologies: Magick.NET-Q16-OpenMP-arm64 (NuGet), Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet), Magick.NET-Q8-x86 (NuGet), Magick.NET-Q8-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet), Magick.NET-Q16-OpenMP-x64 (NuGet), Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet), Magick.NET-Q16-HDRI-arm64 (NuGet), Magick.NET-Q16-HDRI-x86 (NuGet), Magick.NET-Q16-HDRI-x64 (NuGet), Magick.NET-Q8-OpenMP-arm64 (NuGet), Magick.NET-Q8-OpenMP-x64 (NuGet), Magick.NET-Q16-x64 (NuGet), Magick.NET-Q8-arm64 (NuGet), Magick.NET-Q8-x64 (NuGet), Magick.NET-Q16-x86 (NuGet), Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet), ImageMagick. Vendors: NuGet, ImageMagick.

Executive brief

ImageMagick is a widely used open-source tool for editing and converting digital images. A flaw in how it processes image metadata could allow an attacker to read a small amount of memory that they should not have access to. While the impact is limited to reading a single byte of data, such vulnerabilities can sometimes be used to bypass security protections or gain information about the system's memory layout.

Technical details

An off-by-one error (CWE-193) exists in the ImageMagick meta encoder component, leading to a heap-based out-of-bounds read (CWE-125). The vulnerability allows a remote attacker to trigger a single-byte read beyond the intended buffer by providing a specially crafted image file. This occurs during the encoding of image metadata. While the information disclosure is limited to one byte, it represents a memory safety violation. The issue is addressed in ImageMagick versions 6.9.13-47 and 7.1.2-22.

Affected products

  • ImageMagick ImageMagick < 6.9.13-47, < 7.1.2-22

Timeline

  • 2026-05-16: advisory: GitHub Security Advisory published
  • 2026-06-10: disclosed: CVE published to NVD

References

Related threats