CVE-2026-45624
Undergoing Analysis Undergoing Analysis - In Progress
Out-of-Bounds Read in ImageMagick During Polynomial Distortion

Publication date: 2026-06-10

Last updated on: 2026-06-11

Assigner: GitHub, Inc.

Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, when performing a polynomial distortion an out of bounds over-read of 24 bytes can occur when specifying specific arguments. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-10
Last Modified
2026-06-11
Generated
2026-06-11
AI Q&A
2026-06-11
EPSS Evaluated
N/A
NVD
CVE-2026-45624
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
imagemagick imagemagick to 7.1.2-22 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in ImageMagick, a free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, when performing a polynomial distortion operation, an out of bounds over-read of 24 bytes can occur if specific arguments are provided.

An out of bounds over-read means the software reads memory beyond the intended buffer, which can lead to unexpected behavior or crashes.

This issue has been fixed in versions 6.9.13-47 and 7.1.2-22.

Impact Analysis

The vulnerability can lead to a partial denial of service or information disclosure due to the out of bounds memory read.

According to the CVSS v3.1 score of 5.1, the impact is moderate with low attack complexity and no privileges required.

Specifically, the confidentiality impact is low, integrity is not affected, and availability impact is low.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade ImageMagick to version 6.9.13-47 or later, or version 7.1.2-22 or later, where the issue has been patched.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45624. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart