CVE-2026-46559
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an incorrect check in the JP2 will result in an heap buffer over-write of a single byte when specifying certain options. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 4
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- EPSS probability
- 0.12%
- CWE
- CWE-193, CWE-787
- Published
- 2026-06-10
- Last modified
- 2026-09-14
Affected products
- ImageMagick ImageMagick
- ImageMagick ImageMagick
Weakness type
Related vulnerabilities
- CVE-2023-44444 — GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability
- CVE-2026-79148 — Off-by-one error in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social enginee
- CVE-2024-10442 — Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0
- CVE-2021-21938 — A heap-based buffer overflow vulnerability exists in the Palette box parser functionality of Accusoft ImageGear 19.10. A
- CVE-2020-14510 — OFF-BY-ONE ERROR CWE-193
- CVE-2023-30546 — Contiki-NG has off-by-one error in Antelope DBMS
- CVE-2020-10062 — Packet length decoding error in MQTT
- CVE-2024-51554 — off-by-one-error