ImageMagick: Policy Bypass in MNG coder could

Summary

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.

Timeline

1. Jun 10, 2026, 9:30 PM UTCCVE published
2. Jun 11, 2026, 2:09 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Jul 15, 2026, 12:52 AM UTCRecord last updated

Affected versions

• ImageMagick ImageMagick

  fixed in 6.9.13-47; fixed in 7.1.2-22

• Magick.NET-Q16-AnyCPUNuGet

  fixed in 14.13.1

• Magick.NET-Q16-HDRI-AnyCPUNuGet

  fixed in 14.13.1

• Magick.NET-Q16-HDRI-OpenMP-arm64NuGet

  fixed in 14.13.1

• Magick.NET-Q16-HDRI-OpenMP-x64NuGet

  fixed in 14.13.1

• Magick.NET-Q16-HDRI-arm64NuGet

  fixed in 14.13.1

• Magick.NET-Q16-HDRI-x64NuGet

  fixed in 14.13.1

• Magick.NET-Q16-HDRI-x86NuGet

  fixed in 14.13.1

• Magick.NET-Q16-OpenMP-arm64NuGet

  fixed in 14.13.1

• Magick.NET-Q16-OpenMP-x64NuGet

  fixed in 14.13.1

• Magick.NET-Q16-arm64NuGet

  fixed in 14.13.1

• Magick.NET-Q16-x64NuGet

  fixed in 14.13.1

• Magick.NET-Q16-x86NuGet

  fixed in 14.13.1

• Magick.NET-Q8-AnyCPUNuGet

  fixed in 14.13.1

• Magick.NET-Q8-OpenMP-arm64NuGet

  fixed in 14.13.1

• Magick.NET-Q8-OpenMP-x64NuGet

  fixed in 14.13.1

• Magick.NET-Q8-arm64NuGet

  fixed in 14.13.1

• Magick.NET-Q8-x64NuGet

  fixed in 14.13.1

• Magick.NET-Q8-x86NuGet

  fixed in 14.13.1

References 1