CVE-2026-46559

Analyzed Analyzed - Analysis Complete

Heap Buffer Overflow in ImageMagick

Publication date: 2026-06-10

Last updated on: 2026-06-11

Assigner: GitHub, Inc.

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an incorrect check in the JP2 will result in an heap buffer over-write of a single byte when specifying certain options. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-11

Generated

2026-07-01

AI Q&A

2026-06-11

EPSS Evaluated

2026-06-30

NVD

CVE-2026-46559

Affected Vendors & Products

Vendor	Product	Version / Range
imagemagick	imagemagick	to 6.9.13-48 (exc)
imagemagick	imagemagick	From 7.0.0-0 (inc) to 7.1.2-23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.
CWE-193	A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

Attack-Flow Graph

Executive Summary

This vulnerability exists in ImageMagick, a free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, there is an incorrect check in the JP2 (JPEG 2000) image format processing that can cause a heap buffer overwrite of a single byte when certain options are specified.

This means that when processing JP2 images with specific options, the software may write one byte beyond the allocated memory buffer, potentially leading to memory corruption.

The issue has been fixed in versions 6.9.13-48 and 7.1.2-23.

Impact Analysis

The vulnerability can lead to a heap buffer overwrite of a single byte, which is a form of memory corruption.

While the CVSS score indicates a low severity (4.0) with local attack vector and no impact on confidentiality or integrity, the availability of the system or application using ImageMagick could be affected.

Potential impacts include application crashes or unexpected behavior when processing certain JP2 images, which could disrupt services relying on ImageMagick.

Mitigation Strategies

To mitigate this vulnerability, you should update ImageMagick to version 6.9.13-48 or later, or version 7.1.2-23 or later, where the issue has been patched.

Compliance Impact

The provided information does not specify any direct impact of the CVE-2026-46559 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Detection Guidance

This vulnerability affects ImageMagick versions prior to 6.9.13-48 and 7.1.2-23. To detect if your system is vulnerable, you should first check the installed version of ImageMagick.

Run the command `convert --version` or `magick --version` to determine the installed ImageMagick version.

If the version is older than 6.9.13-48 or 7.1.2-23, your system is vulnerable to the heap buffer over-write issue in the JP2 encoder.

There are no specific network detection commands provided for this vulnerability, as it requires local access and is triggered by specifying certain options in JP2 encoding.

Hi! I’m here to help you understand CVE-2026-46559. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70