Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the MNG image decoder within ImageMagick, specifically in how it handles looped animations. The advisory GHSA-g5mf-wqq5-vwg6 points to a policy bypass in the MNG coder. By analyzing the commits between the vulnerable version (7.1.2-21) and the patched version (7.1.2-22), I identified two relevant commits: 6dc0130dbbde34b13126bc4fe25789f894b9e0c1 and 10a1a2285659fe1f8978f338319727dfda19500d. Both commits modify the ReadOneMNGImage function in coders/png.c. The first commit attempted a fix by tracking the number of loops, but this was later refined in the second commit. The final patch introduces a hard limit on the number of LOOP and ENDL operations (MNG_MAX_LOOP_OPS) within the ReadOneMNGImage function. This indicates that the ReadOneMNGImage function was the place where the vulnerability existed, as it was responsible for parsing the MNG file and could be tricked into an infinite loop or excessive processing by a malicious file. Therefore, ReadOneMNGImage is the vulnerable function.
ReadOneMNGImagecoders/png.c
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Magick.NET-Q16-AnyCPU | nuget | < 14.13.1 | 14.13.1 |
| Magick.NET-Q16-HDRI-AnyCPU | nuget | < 14.13.1 | 14.13.1 |
| Magick.NET-Q16-HDRI-OpenMP-arm64 | nuget | < 14.13.1 | 14.13.1 |
| Magick.NET-Q16-HDRI-OpenMP-x64 | nuget | < 14.13.1 | 14.13.1 |
| Magick.NET-Q16-HDRI-arm64 | nuget | < 14.13.1 | 14.13.1 |
| Magick.NET-Q16-HDRI-x64 | nuget | < 14.13.1 | 14.13.1 |
| Magick.NET-Q16-HDRI-x86 | nuget | < 14.13.1 | 14.13.1 |
| Magick.NET-Q16-OpenMP-arm64 | nuget | < 14.13.1 | 14.13.1 |
| Magick.NET-Q16-OpenMP-x64 | nuget | < 14.13.1 | 14.13.1 |
| Magick.NET-Q16-arm64 | nuget | < 14.13.1 | 14.13.1 |
| Magick.NET-Q16-x64 | nuget | < 14.13.1 | 14.13.1 |
| Magick.NET-Q16-x86 | nuget | < 14.13.1 | 14.13.1 |
| Magick.NET-Q8-AnyCPU | nuget | < 14.13.1 | 14.13.1 |
| Magick.NET-Q8-OpenMP-arm64 | nuget | < 14.13.1 | 14.13.1 |
| Magick.NET-Q8-OpenMP-x64 | nuget | < 14.13.1 | 14.13.1 |
| Magick.NET-Q8-arm64 | nuget | < 14.13.1 | 14.13.1 |
| Magick.NET-Q8-x64 | nuget | < 14.13.1 | 14.13.1 |
| Magick.NET-Q8-x86 | nuget | < 14.13.1 | 14.13.1 |