CVE-2026-45359

Modified Modified - Updated After Analysis

Heap Buffer Over-Read in ImageMagick

Publication date: 2026-06-10

Last updated on: 2026-06-30

Assigner: GitHub, Inc.

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-22, an invalid connected-components:keep-top value could result in a heap buffer over-read when performing the connected components operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-22.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-06-11

EPSS Evaluated

2026-06-30

NVD

CVE-2026-45359

Affected Vendors & Products

Vendor	Product	Version / Range
imagemagick	imagemagick	to 6.9.13-48 (exc)
imagemagick	imagemagick	From 7.0.0-0 (inc) to 7.1.2-22 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-129	The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

Impact Analysis

The vulnerability can lead to a heap buffer over-read, which may cause the application to read memory beyond the intended buffer. According to the CVSS score, this can result in high confidentiality impact and low availability impact, meaning sensitive information could potentially be exposed, but the system's integrity and availability are less affected.

Mitigation Strategies

To mitigate this vulnerability, you should update ImageMagick to version 6.9.13-48 or later, or 7.1.2-22 or later, where the issue has been patched.

Executive Summary

This vulnerability exists in ImageMagick, a free and open-source software used for editing and manipulating digital images. Specifically, prior to versions 6.9.13-48 and 7.1.2-22, an invalid value for the connected-components:keep-top parameter could cause a heap buffer over-read during the connected components operation.

Compliance Impact

The vulnerability in ImageMagick allows a heap buffer over-read that can lead to unauthorized reading of memory outside the intended buffer. This can result in a potential high impact on confidentiality of data processed by the software.

Since confidentiality is a key aspect of compliance with standards like GDPR and HIPAA, this vulnerability could pose a risk to compliance if sensitive data is exposed through exploitation.

However, the attack requires local access with high complexity and no user interaction or privileges, which may limit the practical risk in many environments.

Detection Guidance

This vulnerability is related to a heap buffer over-read in ImageMagick when processing an invalid connected-components:keep-top value. Detection involves identifying if vulnerable versions of ImageMagick are installed on your system.

You can check the installed ImageMagick version using the following command:

magick --version

If the version is prior to 6.9.13-48 or 7.1.2-22, your system is vulnerable.

To test for the vulnerability, you could attempt to run a connected components operation with an invalid keep-top value on a test image, but no specific commands for this test are provided in the available resources.

Hi! I’m here to help you understand CVE-2026-45359. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70