CVE-2026-45664

Modified Modified - Updated After Analysis

Resource Exhaustion in ImageMagick via MNG Coder

Publication date: 2026-06-10

Last updated on: 2026-06-30

Assigner: GitHub, Inc.

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-06-11

EPSS Evaluated

2026-06-30

NVD

CVE-2026-45664

Affected Vendors & Products

Vendor	Product	Version / Range
imagemagick	imagemagick	to 6.9.13-47 (exc)
imagemagick	imagemagick	From 7.0.0-0 (inc) to 7.1.2-22 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Impact Analysis

The vulnerability can cause excessive resource use on systems running vulnerable versions of ImageMagick. This could potentially degrade system performance or availability due to the software processing more images than intended, possibly leading to denial of service conditions.

Mitigation Strategies

To mitigate this vulnerability, update ImageMagick to version 6.9.13-47 or later, or version 7.1.2-22 or later, where the issue has been patched.

Detection Guidance

This vulnerability is related to a policy bypass in the MNG decoder of ImageMagick that allows reading more images than the policy limit, causing excessive resource consumption.

To detect if your system is vulnerable, first check the installed ImageMagick version. Versions prior to 6.9.13-47 and 7.1.2-22 are affected.

Run the command `convert --version` or `magick --version` to determine the installed ImageMagick version.

If the version is vulnerable, monitoring system resource usage during image processing tasks involving MNG files may help detect exploitation attempts.

Use system monitoring tools like `top`, `htop`, or `ps` to observe excessive CPU or memory usage when processing images.
Check logs or enable debugging in ImageMagick to identify abnormal processing of MNG images exceeding policy limits.

Executive Summary

This vulnerability exists in ImageMagick, a free and open-source software for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, there was a missing check in the MNG coder component that allowed the software to read more images than the configured list limit policy permitted. This flaw could lead to excessive resource consumption.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-45664. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70