5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46521

CVE-2026-46521: ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compression in the MIFF encoder an out of bounds write can occur due to a missing check. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46521

CVE-2026-46521:

5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-OpenMP-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-x86	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-OpenMP-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-x86	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-AnyCPU	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-OpenMP-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-x86	nuget	< 14.13.1	14.13.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis began by examining the provided security advisory, which pointed to a heap buffer overwrite in the MIFF encoder of ImageMagick when using LZMA compression. The advisory listed patched versions, which allowed for the identification of the specific commit that fixed the vulnerability. By comparing the repository tags of the affected versions, I was able to narrow down the relevant commits. The commit 188fcf538f58a60109ebd008e2c40d29cf3966d7 directly referenced the security advisory in its commit message. Analyzing the changes within this commit revealed modifications to the coders/miff.c file. Specifically, the WriteMIFFImage function was altered to correctly calculate the buffer size for LZMA compression by adding LZMAMaxExtent to the MagickMax calculation. The original code was missing this check, which resulted in an out-of-bounds write when the compressed data was larger than the allocated buffer. Therefore, the WriteMIFFImage function is identified as the vulnerable function.

Vulnerable functions

WriteMIFFImage

coders/miff.c

The vulnerability lies in the `WriteMIFFImage` function, where the buffer size for compressed image data was calculated incorrectly when using LZMA compression. The original code did not account for the maximum possible size of LZMA compressed data, leading to a smaller buffer allocation. When the actual compressed data size exceeded the allocated buffer, a heap-based buffer overflow would occur. The patch corrects this by including `LZMAMaxExtent` in the buffer size calculation, ensuring enough space is allocated.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.