CVE-2026-46521 — ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression

CVE-2026-46521

ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression PUBLISHED

Description (CNA)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compression in the MIFF encoder an out of bounds write can occur due to a missing check. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

Affected (CNA)

Vendor / product	Versions
ImageMagick / ImageMagick	affected < 6.9.13-48; affected < 7.1.2-23

CWE

CWE-131, CWE-252, CWE-787, CWE-835

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jcqp-6r6f-3mfx

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.