CVE-2026-53466: ImageMagick integer overflow in XCF decoder

CVE-2026-53466 · Severity: medium · CVSS 6.5 · Published 2026-07-01

ImageMagick, a widely used tool for processing and editing images, is affected by a security flaw in its XCF image format decoder. By providing a specially crafted image file, an attacker could cause the application to crash or potentially access small amounts of memory it shouldn't be able to see. This could lead to service interruptions for applications that automatically process user-uploaded images.

Technologies: Dlemstra Magick.NET, Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet), Magick.NET-Q16-HDRI-arm64 (NuGet), Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet), Magick.NET-Q16-HDRI-x64 (NuGet), Magick.NET-Q16-HDRI-x86 (NuGet), Magick.NET-Q16-OpenMP-arm64 (NuGet), Magick.NET-Q16-OpenMP-x64 (NuGet), Magick.NET-Q16-x64 (NuGet), Magick.NET-Q16-x86 (NuGet), Magick.NET-Q8-AnyCPU (NuGet), Magick.NET-Q8-arm64 (NuGet), Magick.NET-Q8-OpenMP-arm64 (NuGet), Magick.NET-Q8-OpenMP-x64 (NuGet), Magick.NET-Q8-x64 (NuGet), Magick.NET-Q8-x86 (NuGet). Vendors: Dlemstra, NuGet.

Quick answers

Is CVE-2026-53466 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53466 being exploited in the wild.
How severe is CVE-2026-53466?
Medium severity, with a CVSS score of 6.5, published 1 July 2026.
Which products and versions are affected?
Dlemstra Magick.NET < 14.15.0; Magick.NET-Q16-AnyCPU (NuGet) < 14.15.0, ECOSYSTEM:introduced=0,fixed=14.15.0; Magick.NET-Q16-arm64 (NuGet) < 14.15.0, ECOSYSTEM:introduced=0,fixed=14.15.0; Magick.NET-Q16-HDRI-AnyCPU (NuGet) < 14.15.0, ECOSYSTEM:introduced=0,fixed=14.15.0; and 14 more.
Is there a fix for CVE-2026-53466?
Yes. Magick.NET-Q16-AnyCPU (NuGet): upgrade to 14.15.0 or later; Magick.NET-Q16-arm64 (NuGet): upgrade to 14.15.0 or later; Magick.NET-Q16-HDRI-AnyCPU (NuGet): upgrade to 14.15.0 or later; Magick.NET-Q16-HDRI-arm64 (NuGet): upgrade to 14.15.0 or later; Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet): upgrade to 14.15.0 or later; Magick.NET-Q16-HDRI-x64 (NuGet): upgrade to 14.15.0 or later; Magick.NET-Q16-HDRI-x86 (NuGet): upgrade to 14.15.0 or later; Magick.NET-Q16-OpenMP-arm64 (NuGet): upgrade to 14.15.0 or later; Magick.NET-Q16-OpenMP-x64 (NuGet): upgrade to 14.15.0 or later; Magick.NET-Q16-x64 (NuGet): upgrade to 14.15.0 or later; Magick.NET-Q16-x86 (NuGet): upgrade to 14.15.0 or later; Magick.NET-Q8-AnyCPU (NuGet): upgrade to 14.15.0 or later; Magick.NET-Q8-arm64 (NuGet): upgrade to 14.15.0 or later; Magick.NET-Q8-OpenMP-arm64 (NuGet): upgrade to 14.15.0 or later; Magick.NET-Q8-OpenMP-x64 (NuGet): upgrade to 14.15.0 or later; Magick.NET-Q8-x64 (NuGet): upgrade to 14.15.0 or later; Magick.NET-Q8-x86 (NuGet): upgrade to 14.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53466 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-53466?
Check whether you run Dlemstra Magick.NET, Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Magick.NET-Q16-AnyCPU (NuGet): upgrade to 14.15.0 or later
    dotnet add package Magick.NET-Q16-AnyCPU --version 14.15.0
  • Magick.NET-Q16-arm64 (NuGet): upgrade to 14.15.0 or later
    dotnet add package Magick.NET-Q16-arm64 --version 14.15.0
  • Magick.NET-Q16-HDRI-AnyCPU (NuGet): upgrade to 14.15.0 or later
    dotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.15.0
  • Magick.NET-Q16-HDRI-arm64 (NuGet): upgrade to 14.15.0 or later
    dotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.15.0
  • Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet): upgrade to 14.15.0 or later
    dotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.15.0
  • Magick.NET-Q16-HDRI-x64 (NuGet): upgrade to 14.15.0 or later
    dotnet add package Magick.NET-Q16-HDRI-x64 --version 14.15.0
  • Magick.NET-Q16-HDRI-x86 (NuGet): upgrade to 14.15.0 or later
    dotnet add package Magick.NET-Q16-HDRI-x86 --version 14.15.0
  • Magick.NET-Q16-OpenMP-arm64 (NuGet): upgrade to 14.15.0 or later
    dotnet add package Magick.NET-Q16-OpenMP-arm64 --version 14.15.0
  • Magick.NET-Q16-OpenMP-x64 (NuGet): upgrade to 14.15.0 or later
    dotnet add package Magick.NET-Q16-OpenMP-x64 --version 14.15.0
  • Magick.NET-Q16-x64 (NuGet): upgrade to 14.15.0 or later
    dotnet add package Magick.NET-Q16-x64 --version 14.15.0
  • Magick.NET-Q16-x86 (NuGet): upgrade to 14.15.0 or later
    dotnet add package Magick.NET-Q16-x86 --version 14.15.0
  • Magick.NET-Q8-AnyCPU (NuGet): upgrade to 14.15.0 or later
    dotnet add package Magick.NET-Q8-AnyCPU --version 14.15.0
  • Magick.NET-Q8-arm64 (NuGet): upgrade to 14.15.0 or later
    dotnet add package Magick.NET-Q8-arm64 --version 14.15.0
  • Magick.NET-Q8-OpenMP-arm64 (NuGet): upgrade to 14.15.0 or later
    dotnet add package Magick.NET-Q8-OpenMP-arm64 --version 14.15.0
  • Magick.NET-Q8-OpenMP-x64 (NuGet): upgrade to 14.15.0 or later
    dotnet add package Magick.NET-Q8-OpenMP-x64 --version 14.15.0
  • Magick.NET-Q8-x64 (NuGet): upgrade to 14.15.0 or later
    dotnet add package Magick.NET-Q8-x64 --version 14.15.0
  • Magick.NET-Q8-x86 (NuGet): upgrade to 14.15.0 or later
    dotnet add package Magick.NET-Q8-x86 --version 14.15.0

Technical details

A heap buffer over-read vulnerability exists in ImageMagick's XCF decoder due to an integer conversion overflow (CWE-190, CWE-681). The flaw occurs when the decoder performs incorrect numeric type conversions during the processing of a crafted XCF image, leading to an out-of-bounds read. An attacker can exploit this by providing a malicious image file to be processed by the library, requiring no authentication or specific user interaction beyond the processing itself. This can result in a denial-of-service (crash) or limited information disclosure. The issue is addressed in ImageMagick version 7.1.2-26 and Magick.NET version 14.15.0.

Affected products

  • ImageMagick ImageMagick < 7.1.2-26
  • dlemstra Magick.NET < 14.15.0

Identifiers

  • CVE-2026-53466
  • GHSA-pjxj-pchx-4c3m

Timeline

  • 2026-06-26: disclosed: Initial disclosure by reporter Bin-infinite
  • 2026-07-01: advisory: NVD publication date
  • 2026-07-31: patched: GitHub Advisory published and reviewed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.