CVE-2026-45664: imagemagick Uncontrolled Resource Consumption

Vulnerability summary

CVE-2026-45664 is a medium (CVSS 5.3) Uncontrolled Resource Consumption vulnerability in imagemagick. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49.2% of scored vulnerabilities.

Timeline

1. 10-06-2026
   PublishedVulnerability first disclosed.
2. 15-07-2026
   Last modifiedVulnerability information updated.

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-407Inefficient Algorithmic ComplexityAn algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
• CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.