CVE-2026-46559
MediumCVSS 4.0Exploitation Probability (EPSS)
Low risk2th percentile — higher than 2% of all known CVEs
Summary
ImageMagick prior to versions 6.9.13-48 and 7.1.2-23 contained a flaw in JP2 checking that could lead to a heap buffer over-write of a single byte when certain options were specified. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized memory access, potentially resulting in data leakage or arbitrary code execution. Organizations should be aware of the risks associated with using outdated software versions.
Recommendation
It is recommended to upgrade ImageMagick to versions 6.9.13-48 or 7.1.2-23 to mitigate this vulnerability. Regular software updates are crucial for maintaining system security.
Original NVD description (English source)
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an incorrect check in the JP2 will result in an heap buffer over-write of a single byte when specifying certain options. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.