CVE-2026-45358

Analyzed Analyzed - Analysis Complete

Off-by-One Out-of-Bounds Read in ImageMagick

Publication date: 2026-06-10

Last updated on: 2026-06-11

Assigner: GitHub, Inc.

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, an off by one in the meta encoder could result in an out of bounds read of a single byte in the meta encoder. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-11

Generated

2026-07-01

AI Q&A

2026-06-11

EPSS Evaluated

2026-06-30

NVD

CVE-2026-45358

Affected Vendors & Products

Vendor	Product	Version / Range
imagemagick	imagemagick	to 6.9.13-47 (exc)
imagemagick	imagemagick	From 7.0.0-0 (inc) to 7.1.2-22 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-193	A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in ImageMagick, a free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, there was an off-by-one error in the meta encoder component. This error could cause an out-of-bounds read of a single byte in the meta encoder, potentially leading to unexpected behavior or information disclosure.

Impact Analysis

The vulnerability can lead to an out-of-bounds read of a single byte, which may result in limited information disclosure. According to the CVSS score of 5.3, the impact is considered moderate with a low attack complexity and no privileges or user interaction required. The confidentiality impact is low, while integrity and availability are not affected.

Mitigation Strategies

To mitigate this vulnerability, update ImageMagick to version 6.9.13-47 or later, or version 7.1.2-22 or later, where the issue has been patched.

Compliance Impact

The vulnerability results in a low confidentiality loss due to an out-of-bounds read of a single byte, but it does not impact integrity or availability.

There is no specific information provided about how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-45358. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70