CVE-2026-45664
ImageMagick: Policy Bypass in MNG coder could
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jun 10, 2026
- Updated
- Jul 15, 2026
- Reserved
- May 12, 2026
Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | GitHub_M |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | redhat-SADP |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
ImageMagickImageMagick |
|
References
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g5mf-wqq5-vwg6
- https://access.redhat.com/security/cve/CVE-2026-45664vdb-entry
- RHBZ#2487732issue-tracking
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45664.json
- https://access.redhat.com/errata/RHSA-2026:32961vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.