7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46520

CVE-2026-46520: ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46520

CVE-2026-46520:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-OpenMP-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-x86	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-OpenMP-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-x86	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-AnyCPU	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-OpenMP-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-x86	nuget	< 14.13.1	14.13.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis began by examining the provided GitHub Security Advisory (GHSA-36wm-hprc-mcf5), which describes a heap buffer overflow in the ImageMagick IPL decoder. The advisory specified the patched versions, allowing for a targeted analysis of the code changes. By comparing the git tags for the last vulnerable version (7.1.2-22) and the first patched version (7.1.2-23), a specific commit was identified with the message directly referencing the GHSA ID: 3aa35741316909f9e384d13cee197334dc3296d7.

This commit modifies the file coders/ipl.c. Although the advisory refers to a vulnerability in the "decoder", the patch is located within the WriteIPLImage function, which is the IPL format encoder. The vulnerability is triggered when processing a sequence of images with varying dimensions. The function iterates through a linked list of images but failed to re-initialize the pixel handling structures for each image. If an image in the sequence was larger than its predecessor, the previously allocated buffer would be too small, leading to an out-of-bounds write.

The identified patch addresses this by inserting a call to SetQuantumDepth() at the beginning of the loop for each image. This ensures that the quantum_info structure is correctly configured for the current image's properties before its pixels are processed, thereby preventing the buffer overflow. The vulnerable function is therefore WriteIPLImage, which would be invoked when an application attempts to create a multi-frame IPL image from source images of different sizes.

Vulnerable functions

WriteIPLImage

coders/ipl.c

The function `WriteIPLImage` processes a sequence of images to write them into a single IPL file. It uses a `quantum_info` structure to manage pixel data. The vulnerability existed because this structure was not re-initialized for each image in the sequence. If a subsequent image had different dimensions than the previous one, the pixel buffer (obtained via `GetQuantumPixels`) might not be correctly sized, leading to a heap-based buffer overflow when pixel data was accessed. The patch corrects this by calling `SetQuantumDepth` for each image, ensuring the `quantum_info` is always appropriate for the current image being processed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.