CVE-2026-45664CWE-400CWE-407CWE-674

ImageMagick: Policy Bypass in MNG coder could

Medium · published June 10, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
49.5
In the wild
Unconfirmed
What it is

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00630 · 49.5th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-407 · Inefficient Algorithmic Complexity; CWE-674 · Uncontrolled Recursion
Published
2026-06-10T21:30Z
EPSS history
Timeline
  • 10 JUN 21:30Z
    ImageMagick: Policy Bypass in MNG coder could
    cvelistv5