5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48994

CVE-2026-48994: ImageMagick: Heap Buffer Over-Write in MAT decoder on 32-bit systems

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check of a return value could lead to a heap buffer over-write in the MAT decoder on 32-bit systems. This issue has been patched in versions 6.9.13-48 and 7.1.2-24.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48994

CVE-2026-48994:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-x86	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-OpenMP-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-x86	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-AnyCPU	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-OpenMP-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-x86	nuget	< 14.14.0	14.14.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, described as a heap buffer overwrite in the MAT decoder due to a missing return value check, was traced to a specific commit in the ImageMagick repository. By comparing the git tags for the last vulnerable version (7.1.2-23) and the first patched version (7.1.2-24), the fixing commit 44df3a54af31b8d33fa5e40b4dc61d051c4a5d9a was identified. The commit message explicitly references the associated GHSA ID. Analysis of this commit's patch reveals changes in coders/mat.c, specifically within the ReadMATImageV4 function. The patch introduces checks for the return values of SetQuantumFormat, SetQuantumDepth, and SetQuantumEndian. The absence of these checks in the vulnerable code could cause memory corruption when processing a malicious MAT file, as subsequent operations would use an uninitialized data structure, leading to the heap buffer overflow. Therefore, ReadMATImageV4 is the vulnerable function that would appear in a runtime profile during exploitation.

Vulnerable functions

ReadMATImageV4

coders/mat.c

The function `ReadMATImageV4` is responsible for reading MAT version 4 image files. The vulnerability lies in the insufficient checking of return values from functions that configure the image's quantum information. Specifically, the return value of `SetQuantumFormat` was not checked. If this function failed (e.g., due to a memory allocation failure), the `quantum_info` structure would be in an invalid state. Subsequent calls to `SetQuantumDepth` and `SetQuantumEndian`, and later `GetQuantumPixels`, would operate on this invalid structure, leading to a heap-based buffer overflow when writing pixel data.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.