GHSA-jcqp-6r6f-3mfx CVE-2026-46521
ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression
Medium
NuGet
- Severity
- 5.5 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.11%
- Chance of exploitation in the next 30 days. Higher than 1.32% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-131 Incorrect Calculation of Buffer Size
- CWE-252 Unchecked Return Value
- CWE-787 Out-of-bounds Write
- CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
- Fix
- Available
- 18 packages have a fixed version
Description
When using LZMA compression in the MIFF encoder an out of bounds write can occur due to a missing check.
Affected versions
NuGet
| Package | Vulnerable | Fixed in |
|---|---|---|
| Magick.NET-Q16-AnyCPU | < 14.13.1 |
14.13.1 |
| Magick.NET-Q16-HDRI-AnyCPU | < 14.13.1 |
14.13.1 |
| Magick.NET-Q16-HDRI-OpenMP-arm64 | < 14.13.1 |
14.13.1 |
| Magick.NET-Q16-HDRI-OpenMP-x64 | < 14.13.1 |
14.13.1 |
| Magick.NET-Q16-HDRI-arm64 | < 14.13.1 |
14.13.1 |
| Magick.NET-Q16-HDRI-x64 | < 14.13.1 |
14.13.1 |
| Magick.NET-Q16-HDRI-x86 | < 14.13.1 |
14.13.1 |
| Magick.NET-Q16-OpenMP-arm64 | < 14.13.1 |
14.13.1 |
| Magick.NET-Q16-OpenMP-x64 | < 14.13.1 |
14.13.1 |
| Magick.NET-Q16-arm64 | < 14.13.1 |
14.13.1 |
| Magick.NET-Q16-x64 | < 14.13.1 |
14.13.1 |
| Magick.NET-Q16-x86 | < 14.13.1 |
14.13.1 |
| Magick.NET-Q8-AnyCPU | < 14.13.1 |
14.13.1 |
| Magick.NET-Q8-OpenMP-arm64 | < 14.13.1 |
14.13.1 |
| Magick.NET-Q8-OpenMP-x64 | < 14.13.1 |
14.13.1 |
| Magick.NET-Q8-arm64 | < 14.13.1 |
14.13.1 |
| Magick.NET-Q8-x64 | < 14.13.1 |
14.13.1 |
| Magick.NET-Q8-x86 | < 14.13.1 |
14.13.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
Magick.NET-Q16-AnyCPU NuGet → 14.13.1
- dotnet
dotnet add package Magick.NET-Q16-AnyCPU --version 14.13.1
Magick.NET-Q16-HDRI-AnyCPU NuGet → 14.13.1
- dotnet
dotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.13.1
Magick.NET-Q16-HDRI-OpenMP-arm64 NuGet → 14.13.1
- dotnet
dotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.13.1
Magick.NET-Q16-HDRI-OpenMP-x64 NuGet → 14.13.1
- dotnet
dotnet add package Magick.NET-Q16-HDRI-OpenMP-x64 --version 14.13.1
Magick.NET-Q16-HDRI-arm64 NuGet → 14.13.1
- dotnet
dotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.13.1
Magick.NET-Q16-HDRI-x64 NuGet → 14.13.1
- dotnet
dotnet add package Magick.NET-Q16-HDRI-x64 --version 14.13.1
Magick.NET-Q16-HDRI-x86 NuGet → 14.13.1
- dotnet
dotnet add package Magick.NET-Q16-HDRI-x86 --version 14.13.1
Magick.NET-Q16-OpenMP-arm64 NuGet → 14.13.1
- dotnet
dotnet add package Magick.NET-Q16-OpenMP-arm64 --version 14.13.1
Magick.NET-Q16-OpenMP-x64 NuGet → 14.13.1
- dotnet
dotnet add package Magick.NET-Q16-OpenMP-x64 --version 14.13.1
Magick.NET-Q16-arm64 NuGet → 14.13.1
- dotnet
dotnet add package Magick.NET-Q16-arm64 --version 14.13.1
Magick.NET-Q16-x64 NuGet → 14.13.1
- dotnet
dotnet add package Magick.NET-Q16-x64 --version 14.13.1
Magick.NET-Q16-x86 NuGet → 14.13.1
- dotnet
dotnet add package Magick.NET-Q16-x86 --version 14.13.1
Magick.NET-Q8-AnyCPU NuGet → 14.13.1
- dotnet
dotnet add package Magick.NET-Q8-AnyCPU --version 14.13.1
Magick.NET-Q8-OpenMP-arm64 NuGet → 14.13.1
- dotnet
dotnet add package Magick.NET-Q8-OpenMP-arm64 --version 14.13.1
Magick.NET-Q8-OpenMP-x64 NuGet → 14.13.1
- dotnet
dotnet add package Magick.NET-Q8-OpenMP-x64 --version 14.13.1
Magick.NET-Q8-arm64 NuGet → 14.13.1
- dotnet
dotnet add package Magick.NET-Q8-arm64 --version 14.13.1
Magick.NET-Q8-x64 NuGet → 14.13.1
- dotnet
dotnet add package Magick.NET-Q8-x64 --version 14.13.1
Magick.NET-Q8-x86 NuGet → 14.13.1
- dotnet
dotnet add package Magick.NET-Q8-x86 --version 14.13.1
Severity breakdown
CVSS 3.1 5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-131: Incorrect Calculation of Buffer Size
The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
How to prevent it
- Implementation: When allocating a buffer for the purpose of transforming, converting, or encoding an input, allocate enough memory to handle the largest possible encoding. For example, in a routine that converts "&" characters to "&" for HTML entity encoding, the output buffer needs to be at least 5 times as large as the input buffer.
- Implementation: Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles numbers that are too large or too small for its underlying representation. [REF-7] Also be careful to account for 32-bit, 64-bit, and other potential differences that may affect the numeric representation.
- Implementation: Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
- Architecture and Design: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
- Implementation: When processing structured incoming data containing a size field followed by raw data, identify and resolve any inconsistencies between the size field and the actual size of the data (CWE-130).
- Implementation: When allocating memory that uses sentinels to mark the end of a data structure - such as NUL bytes in strings - make sure you also include the sentinel in your calculation of the total amount of memory that must be allocated.
- Implementation: Replace unbounded copy functions with analogous functions that support length arguments, such as strcpy with strncpy. Create these if they are not available.
- Implementation: Use sizeof() on the appropriate data type to avoid CWE-467.
- Implementation: Use the appropriate type for the desired action. For example, in C/C++, only use unsigned types for values that could never be negative, such as height, width, or other numbers related to quantity. This will simplify validation and will reduce surprises related to unexpected casting.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Use libraries or frameworks that make it easier to handle numbers without unexpected consequences, or buffer allocation routines that automatically track buffer size. Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++). [REF-106]
- Operation, Build and Compilation: Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
- Operation, Build and Compilation: Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code. Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking. For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
- Operation: Use a CPU and operating system that offers Data Execution Protection (using hardware NX or XD bits) or the equivalent techniques that simulate this feature in software, such as PaX [REF-60] [REF-61]. These techniques ensure that any instruction executed is exclusively at a memory address that is part of the code segment. For more information on these techniques see D3-PSEP (Process Segment Execution Prevention) from D3FEND [REF-1336].
- Implementation: Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.
- Architecture and Design, Operation: Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
- Architecture and Design, Operation: Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.
CWE-252: Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
How to prevent it
- Implementation: Check the results of all functions that return a value and verify that the value is expected.
- Implementation: For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
- Implementation: Ensure that you account for all possible return values from the function.
- Implementation: When designing a function, make sure you return a value or throw an exception in case of an error.
CWE-787: Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
How to prevent it
- Requirements: Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.
- Operation, Build and Compilation: Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
- Implementation: Consider adhering to the following rules when allocating and managing an application's memory: Double check that the buffer is as large as specified. When using functions that accept a number of bytes to copy, such as strncpy(), be aware that if the destination buffer size is equal to the source buffer size, it may not NULL-terminate the string. Check buffer boundaries if accessing the buffer in a loop and make sure there is no danger of writing past the allocated space. If necessary, truncate all input strings to a reasonable length before passing them to the copy and concatenation functions.
- Operation, Build and Compilation: Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code. Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking. For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
- Operation: Use a CPU and operating system that offers Data Execution Protection (using hardware NX or XD bits) or the equivalent techniques that simulate this feature in software, such as PaX [REF-60] [REF-61]. These techniques ensure that any instruction executed is exclusively at a memory address that is part of the code segment. For more information on these techniques see D3-PSEP (Process Segment Execution Prevention) from D3FEND [REF-1336].
- Implementation: Replace unbounded copy functions with analogous functions that support length arguments, such as strcpy with strncpy. Create these if they are not available.
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-j7hp-h8jx-5ppr libwebp: OOB write in BuildHuffmanTable | High Known exploited | Also affects magick.net-q16-anycpu |
| GHSA-cvhv-g4rq-3hmw ImageMagick: Memory Leak when providing invalid options to the cli | Medium | Also affects Magick.NET-Q16-AnyCPU |
| GHSA-h22j-f9xw-xjjm ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds | Medium | Also affects Magick.NET-Q16-AnyCPU |
| GHSA-422r-8c97-xcg4 ImageMagick: Heap Buffer Over-Write in fx operation | Medium | Also affects Magick.NET-Q16-AnyCPU |
| GHSA-f5m7-cqgw-8hm7 ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided | Medium | Also affects Magick.NET-Q16-AnyCPU |
| GHSA-hc76-7mpc-qjqh ImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797 | Medium | Also affects Magick.NET-Q16-AnyCPU |
| GHSA-56m6-8q75-f2rw ImageMagick: Policy Bypass due to an incomplete fix of CVE-2026-49219 | Medium | Also affects Magick.NET-Q16-AnyCPU |
| GHSA-h5r4-w88w-7ccr ImageMagick: Memory Leak in TIFF encoder when invalid tiff:tile-geometry is specified | Low | Also affects Magick.NET-Q16-AnyCPU |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor