CVE-2026-42326
Received Received - Intake
Out-of-Bounds Read in ImageMagick

Publication date: 2026-06-10

Last updated on: 2026-06-10

Assigner: GitHub, Inc.

Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, when writing an IPTC output file a malicious input file could cause an out of bounds read of a single byte. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-10
Last Modified
2026-06-10
Generated
2026-06-11
AI Q&A
2026-06-11
EPSS Evaluated
N/A
NVD
CVE-2026-42326
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
imagemagick image_magick to 6.9.13-47|end_excluding=7.1.2-22 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
CWE-191 The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in ImageMagick, a free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, when writing an IPTC output file, a malicious input file could trigger an out of bounds read of a single byte.

An out of bounds read means the software reads memory outside the intended buffer, which can lead to unexpected behavior or crashes.

This issue has been fixed in versions 6.9.13-47 and 7.1.2-22.

Impact Analysis

The vulnerability can cause an out of bounds read of a single byte when processing malicious input files, which may lead to application crashes or denial of service.

According to the CVSS score of 5.1, the impact is moderate with low attack complexity and no user interaction required, but it requires local access.

The confidentiality impact is low, integrity is not affected, and availability impact is low.

Mitigation Strategies

To mitigate this vulnerability, update ImageMagick to version 6.9.13-47 or later, or 7.1.2-22 or later, where the issue has been patched.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42326. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart