7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-53461

CVE-2026-53461: ImageMagick: Out-of-bounds write in ICON decoder due to incorrect loop

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, an incorrect loop in the ICON decoder can result in an out of bounds heap write resulting in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-53461

CVE-2026-53461:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-x86	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-OpenMP-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-x86	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-AnyCPU	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-OpenMP-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-x86	nuget	< 14.14.0	14.14.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, described as an out-of-bounds write in the ICON decoder, was traced back to a specific commit in the ImageMagick repository. By comparing the git tags for the versions just before and after the patch was applied (7.1.2-24 and 7.1.2-25), I identified a commit with a message that directly referenced the security advisory GHSA-g22q-f7gc-5jhr. Analyzing this commit revealed a one-line change in the coders/icon.c file within the Read1XImage function. The loop condition was changed from iterating based on image->columns to image->rows. This incorrect loop boundary is the root cause of the heap buffer overflow. An attacker could craft an ICON file with a larger width than height, causing the loop to write data beyond the allocated memory for the image rows, leading to a denial of service or other potential impacts.

Vulnerable functions

Read1XImage

coders/icon.c

The vulnerability exists in the `Read1XImage` function within the `coders/icon.c` file. The function uses a `for` loop that incorrectly iterates up to the number of columns (`image->columns`) instead of the number of rows (`image->rows`). This can cause an out-of-bounds write on the heap when processing a specially crafted ICON file where the width is greater than the height, leading to a crash or potential code execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.