CVE-2026-42326

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, when writing an IPTC output file a malicious input file could cause an out of bounds read of a single byte. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.

CVSS v3 5.1 MEDIUM

5.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7wff-wpr6-vmhm	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:imagemagick:imagemagick::::::::
	cpe:2.3:a:imagemagick:imagemagick::::::::

History

23 Jul 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) ImageMagick es un software libre y de código abierto utilizado para editar y manipular imágenes digitales. Antes de las versiones 6.9.13-47 y 7.1.2-22, al escribir un archivo de salida IPTC, un archivo de entrada malicioso podría causar una lectura fuera de límites de un solo byte. Este problema ha sido parcheado en las versiones 6.9.13-47 y 7.1.2-22.

11 Jun 2026, 18:41

Type	Values Removed	Values Added
References	~~() https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7wff-wpr6-vmhm -~~	() https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7wff-wpr6-vmhm - Vendor Advisory
First Time		Imagemagick Imagemagick imagemagick
CPE		cpe:2.3:a:imagemagick:imagemagick::::::::

10 Jun 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-10 22:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-42326

Mitre link : CVE-2026-42326

CVE.ORG link : CVE-2026-42326

JSON object : View

Products Affected

imagemagick

imagemagick

CWE

CWE-125

Out-of-bounds Read

CWE-191

Integer Underflow (Wrap or Wraparound)

{"id": "CVE-2026-42326", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42326", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-11T12:52:39.476129Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.5}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ImageMagick", "product": "ImageMagick", "versions": [{"status": "affected", "version": "< 6.9.13-47"}, {"status": "affected", "version": "< 7.1.2-22"}]}]}], "published": "2026-06-10T22:16:57.250", "references": [{"url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7wff-wpr6-vmhm", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-191"}]}], "descriptions": [{"lang": "en", "value": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, when writing an IPTC output file a malicious input file could cause an out of bounds read of a single byte. This issue has been patched in versions 6.9.13-47 and 7.1.2-22."}, {"lang": "es", "value": "ImageMagick es un software libre y de c\u00f3digo abierto utilizado para editar y manipular im\u00e1genes digitales. Antes de las versiones 6.9.13-47 y 7.1.2-22, al escribir un archivo de salida IPTC, un archivo de entrada malicioso podr\u00eda causar una lectura fuera de l\u00edmites de un solo byte. Este problema ha sido parcheado en las versiones 6.9.13-47 y 7.1.2-22."}], "lastModified": "2026-07-23T09:10:00.113", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C825A5B5-E252-445A-8216-968C729E05C7", "versionEndExcluding": "6.9.13-47"}, {"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64E7E76C-2AFF-4C9C-8E67-976B54F4433F", "versionEndExcluding": "7.1.2-22", "versionStartIncluding": "7.0.0-0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}