CVE-2026-53466

Summary

ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow

Severity

medium

CVSS

6.5

EPSS

0.2% (p12)

CWE

CWE-190, CWE-681

Also known as

GHSA-pjxj-pchx-4c3m#Magick.NET-Q16-AnyCPU

Published

2026-07-31

Updated

2026-07-31

Advisory details

An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read and that can result in a crash.

References

• https://github.com/advisories/GHSA-pjxj-pchx-4c3m
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pjxj-pchx-4c3m
• https://nvd.nist.gov/vuln/detail/CVE-2026-53466
• https://github.com/ImageMagick/ImageMagick/commit/47ca7210515f3c9ea033b86fe4323a70caa74468
• https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-26
• https://github.com/dlemstra/Magick.NET/releases/tag/14.15.0

Related advisories

• CVE-2026-62946 — medium · NuGet/Magick.NET-Q16-AnyCPU
• CVE-2026-62343 — medium · NuGet/Magick.NET-Q16-AnyCPU
• CVE-2026-107224 — medium · Go/github.com/xuri/excelize/v2
• CVE-2026-61799 — medium · Maven/io.netty.incubator:netty-incubator-codec-bhttp
• CVE-2026-53461 — high · NuGet/Magick.NET-Q16-AnyCPU
• CVE-2026-53460 — high · NuGet/Magick.NET-Q16-AnyCPU
• CVE-2026-49218 — high · NuGet/Magick.NET-Q16-AnyCPU
• CVE-2026-46522 — high · NuGet/Magick.NET-Q16-AnyCPU

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity