ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged

published 2026-07-01 4 mo ago modified 2026-07-30 3 mo ago also EUVD-2026-41119 , GHSA-8g53-9m3c-69xg , JLSEC-2026-1035

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 9%
public exploits: 0; none known

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a possible heap information disclosure vulnerability because part of the pixels are left unchanged. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.

Patch / fix

fixed in 19 distros 4 links 1

nuget Magick.NET-Q16-AnyCPU 14.15.0
nuget Magick.NET-Q16-HDRI-AnyCPU 14.15.0
nuget Magick.NET-Q16-HDRI-OpenMP-arm64 14.15.0
nuget Magick.NET-Q16-HDRI-x64 14.15.0
nuget Magick.NET-Q16-HDRI-x86 14.15.0
nuget Magick.NET-Q16-OpenMP-arm64 14.15.0
nuget Magick.NET-Q16-OpenMP-x64 14.15.0
nuget Magick.NET-Q16-arm64 14.15.0
nuget Magick.NET-Q16-x64 14.15.0
nuget Magick.NET-Q16-x86 14.15.0
nuget Magick.NET-Q8-AnyCPU 14.15.0
nuget Magick.NET-Q8-OpenMP-arm64 14.15.0
nuget Magick.NET-Q8-OpenMP-x64 14.15.0
nuget Magick.NET-Q8-arm64 14.15.0
nuget Magick.NET-Q8-x64 14.15.0
nuget Magick.NET-Q8-x86 14.15.0
nuget Magick.NET-Q16-HDRI-arm64 14.15.0
julia ImageMagick_jll 7.1.2028+0
imagemagick imagemagick 6.9.13-51, 7.1.2-26

debian suse opensuse alpine

imagemagick Debian 12 8:6.9.11.60+dfsg-1.6+deb12u12
imagemagick Debian 13 8:7.1.1.43+dfsg1-1+deb13u11
imagemagick Debian 14 8:7.1.2.26+dfsg1-1

debian advisories DEBIAN-CVE-2026-53467

ImageMagick SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 7.1.0.9-150400.6.96.1
ImageMagick SLE Module for Development Tools 15 SP7, SLE Module for Desktop Applications 15 SP7 7.1.1.43-150700.3.65.1
ImageMagick SLES for SAP applications 16.0, SLES 16.0 7.1.2.0-160000.11.1
ImageMagick SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 6.8.8.1-71.259.1
ImageMagick SLES for SAP 15 SP6, SLES 15 SP6-LTSS 7.1.1.21-150600.3.73.1

suse advisories SUSE-SU-2026:3053-1 SUSE-SU-2026:3024-1 SUSE-SU-2026:3023-1 SUSE-SU-2026:2877-1 SUSE-SU-2026:22620-1

ImageMagick openSUSE Leap 16.0 7.1.2.0-160000.11.1
ImageMagick openSUSE Tumbleweed 7.1.2.27-1.1

opensuse advisories openSUSE-SU-2026:21291-1 openSUSE-SU-2026:11228-1

imagemagick Alpine 3.24, Alpine 3.23 7.1.2.27-r0

alpine advisories ALPINE-CVE-2026-53467

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

github.com/dlemstra/Magick.NET/releases/tag/14.15.0 release

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-53467 updated 2026-11-05 cvss 5.3

ImageMagick: ImageMagick: Information disclosure vulnerability in MNG decoder

Red Hat Enterprise Linux 6 ImageMagick, ImageMagick-c++, ImageMagick-perl Red Hat Enterprise Linux 7 ImageMagick, ImageMagick-c++, ImageMagick-perl
affected: workaround, no fix planned “Out of support scope”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 4 mo ago (2026-07-01)

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
GitHub	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
OSV	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
nuget	Magick.NET-Q16-AnyCPU	<14.15.0	14.15.0
nuget	Magick.NET-Q16-HDRI-AnyCPU	<14.15.0	14.15.0
nuget	Magick.NET-Q16-HDRI-OpenMP-arm64	<14.15.0	14.15.0
nuget	Magick.NET-Q16-HDRI-x64	<14.15.0	14.15.0
nuget	Magick.NET-Q16-HDRI-x86	<14.15.0	14.15.0
nuget	Magick.NET-Q16-OpenMP-arm64	<14.15.0	14.15.0
nuget	Magick.NET-Q16-OpenMP-x64	<14.15.0	14.15.0
nuget	Magick.NET-Q16-arm64	<14.15.0	14.15.0
nuget	Magick.NET-Q16-x64	<14.15.0	14.15.0
nuget	Magick.NET-Q16-x86	<14.15.0	14.15.0
nuget	Magick.NET-Q8-AnyCPU	<14.15.0	14.15.0
nuget	Magick.NET-Q8-OpenMP-arm64	<14.15.0	14.15.0
nuget	Magick.NET-Q8-OpenMP-x64	<14.15.0	14.15.0
nuget	Magick.NET-Q8-arm64	<14.15.0	14.15.0
nuget	Magick.NET-Q8-x64	<14.15.0	14.15.0
nuget	Magick.NET-Q8-x86	<14.15.0	14.15.0
nuget	Magick.NET-Q16-HDRI-arm64	<14.15.0	14.15.0
julia	ImageMagick_jll	<7.1.2028+0	7.1.2028+0

Affected products

ImageMagick ImageMagick

Classification

Weakness

CWE-908 Use of Uninitialized Resource
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

github.com /ImageMagick/ImageMagick/security/advisories/GHSA-8g53-9m3c-69xg
web, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2026-53467
advisory, web
github.com /ImageMagick/ImageMagick
package
github.com /dlemstra/Magick.NET/releases/tag/14.15.0
web
github.com /advisories/GHSA-8g53-9m3c-69xg
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary