# CVE-2026-62946: ImageMagick integer overflow in JNX decoder

Source: https://junglewise.ai/threats/cve-2026-62946-imagemagick-integer-overflow-in-jnx-decoder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-62946 · Severity: medium · CVSS 5.1 · Published 2026-07-30

ImageMagick is a widely used open-source tool for creating, editing, and converting digital images. A flaw in how it handles specific image files (JNX format) on 32-bit systems could allow a specially crafted file to crash the application. This could lead to service disruptions for organizations that use ImageMagick to process user-uploaded images or automate media workflows.

Technologies: [ImageMagick](https://junglewise.ai/threats/technologies/imagemagick), [Magick.NET-Q16-AnyCPU (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-anycpu), [Magick.NET-Q16-HDRI-AnyCPU (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-anycpu), [Magick.NET-Q16-HDRI-x86 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-x86), [Magick.NET-Q16-x86 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-x86), [Magick.NET-Q8-AnyCPU (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q8-anycpu), [Magick.NET-Q8-x86 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q8-x86). Vendors: [ImageMagick](https://junglewise.ai/threats/vendors/imagemagick), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-62946 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62946 being exploited in the wild.

**How severe is CVE-2026-62946?** Medium severity, with a CVSS score of 5.1, published 30 July 2026.

**Which products and versions are affected?** ImageMagick < 14.15.0; Magick.NET-Q16-AnyCPU (NuGet) < 14.15.0, ECOSYSTEM:introduced=0,fixed=14.15.0; Magick.NET-Q16-HDRI-AnyCPU (NuGet) < 14.15.0, ECOSYSTEM:introduced=0,fixed=14.15.0; Magick.NET-Q16-HDRI-x86 (NuGet) < 14.15.0, ECOSYSTEM:introduced=0,fixed=14.15.0; and 3 more.

**Is there a fix for CVE-2026-62946?** Yes. Magick.NET-Q16-AnyCPU (NuGet): upgrade to 14.15.0 or later; Magick.NET-Q16-HDRI-AnyCPU (NuGet): upgrade to 14.15.0 or later; Magick.NET-Q16-HDRI-x86 (NuGet): upgrade to 14.15.0 or later; Magick.NET-Q16-x86 (NuGet): upgrade to 14.15.0 or later; Magick.NET-Q8-AnyCPU (NuGet): upgrade to 14.15.0 or later; Magick.NET-Q8-x86 (NuGet): upgrade to 14.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62946 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-62946?** Check whether you run ImageMagick, Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Magick.NET-Q16-AnyCPU (NuGet): upgrade to 14.15.0 or later

  ```sh
  dotnet add package Magick.NET-Q16-AnyCPU --version 14.15.0
  ```

- Magick.NET-Q16-HDRI-AnyCPU (NuGet): upgrade to 14.15.0 or later

  ```sh
  dotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.15.0
  ```

- Magick.NET-Q16-HDRI-x86 (NuGet): upgrade to 14.15.0 or later

  ```sh
  dotnet add package Magick.NET-Q16-HDRI-x86 --version 14.15.0
  ```

- Magick.NET-Q16-x86 (NuGet): upgrade to 14.15.0 or later

  ```sh
  dotnet add package Magick.NET-Q16-x86 --version 14.15.0
  ```

- Magick.NET-Q8-AnyCPU (NuGet): upgrade to 14.15.0 or later

  ```sh
  dotnet add package Magick.NET-Q8-AnyCPU --version 14.15.0
  ```

- Magick.NET-Q8-x86 (NuGet): upgrade to 14.15.0 or later

  ```sh
  dotnet add package Magick.NET-Q8-x86 --version 14.15.0
  ```


## Technical details

An integer overflow vulnerability (CWE-190) exists in the JNX decoder of ImageMagick when running on 32-bit architectures. The flaw is triggered when the application processes an exceptionally large JNX image file, leading to a heap buffer overwrite. While the attack vector is local and requires high complexity to exploit, it can result in a denial-of-service (DoS) condition by crashing the process. The issue is specific to 32-bit builds and has been addressed in versions 6.9.13-52 and 7.1.2-27.

## Affected products

- ImageMagick ImageMagick < 6.9.13-52, < 7.1.2-27 (32-bit builds only)

## Identifiers

- CVE-2026-62946
- GHSA-h22j-f9xw-xjjm

## Timeline

- 2026-07-15: advisory: GitHub Security Advisory published
- 2026-07-30: disclosed: NVD publication date

## References

- [https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h22j-f9xw-xjjm](https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h22j-f9xw-xjjm)

## Related threats

- [ImageMagick infinite loop in SVG decoder](https://junglewise.ai/threats/cve-2026-123273-imagemagick-before-7-1-2-35-and-6-9-13-60-contains-an-infinite)
- [ImageMagick memory leak in XMP profile handling](https://junglewise.ai/threats/cve-2026-116155-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a)
- [ImageMagick memory leak in XML parsing depth limit](https://junglewise.ai/threats/cve-2026-116154-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a)
- [ImageMagick memory leak in MAT decoder](https://junglewise.ai/threats/cve-2026-116152-imagemagick-before-7-1-2-33-contains-a-memory-leak-vulnerability)
- [ImageMagick stack buffer overflow in bzip2 decompression](https://junglewise.ai/threats/cve-2026-116149-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a)