5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45358

CVE-2026-45358: ImageMagick: Out-of-Bounds Read of a single byte in meta encoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, an off by one in the meta encoder could result in an out of bounds read of a single byte in the meta encoder. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45358

CVE-2026-45358:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-OpenMP-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-x86	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-OpenMP-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-x86	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-AnyCPU	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-OpenMP-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-x86	nuget	< 14.13.1	14.13.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis began by examining the provided vulnerability details, which pointed to an out-of-bounds read in the meta encoder of ImageMagick. The reference to GHSA-cr6r-hmj8-pr7r and the patched versions (e.g., 7.1.2-22) were key starting points. By comparing the commits between the vulnerable version 7.1.2-21 and the patched version 7.1.2-22, a specific commit (2cf3b5750bd7c96fbb92c3f02823ecd63f8dd232) was identified with a message directly referencing the security advisory. Analyzing the patch in this commit revealed a change in coders/meta.c within the GetIPTCStream function. The patch added a bounds check after a variable tag_length was incremented, confirming that the original code was vulnerable to an out-of-bounds read due to an off-by-one error. This function is responsible for processing IPTC data streams, and a crafted input could trigger this vulnerability.

Vulnerable functions

GetIPTCStream

coders/meta.c

The vulnerability exists in the `GetIPTCStream` function within `coders/meta.c`. An off-by-one error could occur when handling IPTC data. If `tag_length` is odd, it is incremented. Without a bounds check, this increment could cause `tag_length` to exceed the buffer `extent`, leading to an out-of-bounds read in the line `p+=(ptrdiff_t) tag_length;`. The patch mitigates this by adding a check to ensure `tag_length` does not exceed `extent` after being incremented.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.