CVE-2026-45624

Analyzed Analyzed - Analysis Complete

Out-of-Bounds Read in ImageMagick During Polynomial Distortion

Publication date: 2026-06-10

Last updated on: 2026-06-11

Assigner: GitHub, Inc.

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, when performing a polynomial distortion an out of bounds over-read of 24 bytes can occur when specifying specific arguments. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-11

Generated

2026-07-01

AI Q&A

2026-06-11

EPSS Evaluated

2026-06-30

NVD

CVE-2026-45624

Affected Vendors & Products

Vendor	Product	Version / Range
imagemagick	imagemagick	to 6.9.13-47 (exc)
imagemagick	imagemagick	From 7.0.0-0 (inc) to 7.1.2-22 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-129	The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

Executive Summary

This vulnerability exists in ImageMagick, a free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, when performing a polynomial distortion operation, an out of bounds over-read of 24 bytes can occur if specific arguments are provided.

An out of bounds over-read means the software reads memory beyond the intended buffer, which can lead to unexpected behavior or crashes.

This issue has been fixed in versions 6.9.13-47 and 7.1.2-22.

Impact Analysis

The vulnerability can lead to a partial denial of service or information disclosure due to the out of bounds memory read.

According to the CVSS v3.1 score of 5.1, the impact is moderate with low attack complexity and no privileges required.

Specifically, the confidentiality impact is low, integrity is not affected, and availability impact is low.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade ImageMagick to version 6.9.13-47 or later, or version 7.1.2-22 or later, where the issue has been patched.

Compliance Impact

The vulnerability allows an attacker to perform a heap buffer over-read of 24 bytes, potentially leading to a low impact on confidentiality and availability. This could theoretically expose sensitive information if exploited, which might affect compliance with standards and regulations that require protection of confidential data, such as GDPR and HIPAA.

However, the provided information does not explicitly describe any direct impact on compliance with these standards or regulations.

Hi! I’m here to help you understand CVE-2026-45624. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70