5.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42326

CVE-2026-42326: ImageMagick: Heap Buffer Over-Read in IPTC encoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, when writing an IPTC output file a malicious input file could cause an out of bounds read of a single byte. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42326

CVE-2026-42326:

5.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-OpenMP-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-x86	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-OpenMP-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-x86	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-AnyCPU	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-OpenMP-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-x86	nuget	< 14.13.1	14.13.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis began by examining the GitHub Security Advisory, which described a heap buffer over-read in the IPTC encoder of ImageMagick. The advisory did not link to a specific commit, so a Google search was performed using the GHSA ID, GHSA-7wff-wpr6-vmhm. This search uncovered a changelog entry for ImageMagick that referenced the GHSA ID and pointed to commit 0630159. By retrieving the information for this commit, a patch in the coders/meta.c file was identified. The patch modified a boundary check within the GetIPTCStream function from if (tag_length > (length+1)) to if (tag_length > length). This change directly addresses the single-byte out-of-bounds read vulnerability. Therefore, the GetIPTCStream function is the vulnerable function, as it is responsible for processing the malicious IPTC data that could trigger the heap buffer over-read.

Vulnerable functions

GetIPTCStream

coders/meta.c

The function `GetIPTCStream` parses IPTC data from an image. The vulnerability is in a loop that reads data tags. The length of a tag, `tag_length`, is read from the input data and is then used to check if it's within the bounds of the remaining data length. The original code `if (tag_length > (length+1))` allowed for a one-byte out-of-bounds read because it permitted `tag_length` to be equal to `length + 1`. When the pointer `p` is advanced by this `tag_length`, it moves past the allocated buffer, leading to a heap buffer over-read in the next iteration of the loop.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

5.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-42326: ImageMagick: Heap Buffer Over-Read in IPTC encoder

CVE-2026-42326:

5.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Detect and Respond To Threats Faster.

CVE-2026-42326: ImageMagick: Heap Buffer Over-Read in IPTC encoder

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

5.1

5.1

Basic Information

Basic Information

5.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-42326: ImageMagick: Heap Buffer Over-Read in IPTC encoder

CVE-2026-42326:

5.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

CVE-2026-42326: ImageMagick: Heap Buffer Over-Read in IPTC encoder

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

5.1

5.1

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI