PT-2026-41686 · Imagemagick+5 · Imagemagick+19

Published 2026-05-18 · Updated 2026-06-10 · CVE-2026-42326

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description A malicious input file can cause an out-of-bounds read of a single byte when writing an IPTC output file. An out-of-bounds read occurs when a program reads data past the end or before the beginning of the intended buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Integer Underflow

Weakness Enumeration

CWE-125

CWE-191

Related Identifiers

CVE-2026-42326

ECHO-5273-C4A4-86BD

GHSA-7WFF-WPR6-VMHM

OESA-2026-2386

OESA-2026-2387

OESA-2026-2388

OESA-2026-2389

OESA-2026-2463

Affected Products

Imagemagick

Magick.Net-Q16-Anycpu

Magick.Net-Q16-Hdri-Anycpu

Magick.Net-Q16-Hdri-Openmp-Arm64

Magick.Net-Q16-Hdri-Openmp-X64

Magick.Net-Q16-Hdri-Arm64

Magick.Net-Q16-Hdri-X64

Magick.Net-Q16-Hdri-X86

Magick.Net-Q16-Openmp-Arm64

Magick.Net-Q16-Openmp-X64

Magick.Net-Q16-Arm64

Magick.Net-Q16-X64

Magick.Net-Q16-X86

Magick.Net-Q8-Anycpu

Magick.Net-Q8-Openmp-Arm64

Magick.Net-Q8-Openmp-X64

Magick.Net-Q8-Arm64

Magick.Net-Q8-X64

Magick.Net-Q8-X86

Rootio-Imagemagick

References · 36

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7wff-wpr6-vmhm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45359 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-46522 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2389 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-42326 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45664 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-45358 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-46692 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42326 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42326 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2386 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2463 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46523 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-47166 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-46559 · Security Note