CVE-2026-45358
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile — higher than 9% of all known CVEs
Summary
ImageMagick prior to versions 6.9.13-47 and 7.1.2-22 contained an 'off by one' error in the meta encoder, which could lead to an out of bounds read of a single byte. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized memory access, posing a risk of data leakage or application crashes.
Recommendation
It is recommended to update ImageMagick to versions 6.9.13-47 or 7.1.2-22 to mitigate this vulnerability.
Original NVD description (English source)
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, an off by one in the meta encoder could result in an out of bounds read of a single byte in the meta encoder. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.