CVE-2026-48994

MediumCVSS 5.9/10Last modified Jul 23, 2026

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check of a return value could lead to a heap buffer over-write in the MAT decoder on 32-bit systems. This issue has been patched in versions 6.9.13-48 and 7.1.2-24.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-122

Affected software

No affected versions have been published.

Timeline

Published: Jun 10, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-489957.5pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can serve whatever tarball it wants and pnpm CVE-2026-489966.1Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter CVE-2026-489977.1e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize d CVE-2026-489985.3guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation when CVE-2026-489995.7Attackers carefully craft malicious scripts, such as JavaScript, and inject them into target systems; when other users access pages containi CVE-2026-49005.3A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file /dbfood/localhost.CVE-2026-490007.0An insecure password scheme refers to vulnerabilities arising from improper selection of encryption algorithms, inadequate key management, o CVE-2026-490015.3Cross-site request forgery (CSRF) vulnerabilities allow attackers to exploit a user's authenticated session to forge cross-site requests, in CVE-2026-490029.1Access control failure means that an application does not effectively check user access permissions, so that unauthorized users can access s CVE-2026-490039.6Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash and beco CVE-2026-490046.5The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service CVE-2026-490052.4The root password hash of the device can be obtained through unencrypted information in the firmware.