CVE-2026-45358 Overview
CVE-2026-45358 is an out-of-bounds read vulnerability in ImageMagick, the open-source software suite used for editing and manipulating digital images. The flaw resides in the meta encoder, where an off-by-one error causes a single-byte read past the end of an allocated buffer. The issue is classified under [CWE-125] (Out-of-bounds Read) and affects ImageMagick versions prior to 6.9.13-47 and 7.1.2-22. Attackers can trigger the condition over the network by supplying a crafted image to a system that processes it through the meta encoder. Successful exploitation can disclose a single byte of adjacent memory, which may leak information useful for follow-on attacks.
Critical Impact
A remote attacker can cause ImageMagick's meta encoder to read one byte beyond an allocated buffer, leading to limited information disclosure without requiring authentication or user interaction.
Affected Products
- ImageMagick versions prior to 6.9.13-47 (6.x branch)
- ImageMagick versions prior to 7.1.2-22 (7.x branch)
- Applications and services that embed ImageMagick libraries for image processing
Discovery Timeline
- 2026-06-10 - CVE-2026-45358 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-45358
Vulnerability Analysis
The vulnerability is an off-by-one out-of-bounds read in ImageMagick's meta encoder. ImageMagick's meta encoder handles image metadata serialization during write operations. An incorrect boundary calculation causes the encoder to read one byte beyond the end of an allocated buffer.
The attack does not require authentication or user interaction. An attacker only needs the target application to process an attacker-influenced image through the meta encoder. Because the over-read is limited to a single byte, the practical impact is constrained to information disclosure rather than memory corruption or code execution.
The affected functionality is broadly deployed. ImageMagick is embedded in web applications, content management systems, document processing pipelines, and cloud image services, expanding the attack surface beyond standalone ImageMagick installations.
Root Cause
The root cause is an off-by-one error in the meta encoder's loop or index logic. The code accesses one position past the valid end of its source buffer, producing an out-of-bounds read of one byte. This pattern is a common boundary condition error where a comparison uses <= instead of <, or where a length calculation omits a terminating offset.
Attack Vector
The attack vector is network-based. An adversary delivers a crafted image to an application that invokes ImageMagick's meta encoder, for example through an upload endpoint, an image conversion API, or an automated processing pipeline. When ImageMagick encodes metadata on the malicious input, the off-by-one read occurs. The resulting single-byte leak can be returned in encoded output or inferred from observable side effects, depending on how the host application surfaces the encoder's results.
No verified proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-cr6r-hmj8-pr7r for upstream technical details.
Detection Methods for CVE-2026-45358
Indicators of Compromise
- Repeated image uploads from a single source containing malformed or unusual metadata structures targeting the meta encoder.
- ImageMagick process crashes or sanitizer reports referencing one-byte reads in meta encoder routines.
- Anomalous output from image conversion endpoints containing fragments of unrelated process memory.
Detection Strategies
- Inventory all systems running ImageMagick and identify versions older than 6.9.13-47 (6.x) or 7.1.2-22 (7.x).
- Enable AddressSanitizer or Valgrind in test environments to surface single-byte over-reads during fuzzing of the meta encoder.
- Apply Web Application Firewall (WAF) rules that flag images with malformed metadata segments submitted to processing endpoints.
Monitoring Recommendations
- Log image processing operations with file hashes, source IPs, and ImageMagick version to support post-incident analysis.
- Monitor for abnormal rates of image upload errors or encoder failures that may indicate fuzzing or exploitation attempts.
- Forward image-processing service logs to a centralized analytics platform for correlation against known indicators.
How to Mitigate CVE-2026-45358
Immediate Actions Required
- Upgrade ImageMagick to version 6.9.13-47 or later on the 6.x branch, or 7.1.2-22 or later on the 7.x branch.
- Audit all applications, containers, and base images that bundle ImageMagick and rebuild them against the patched libraries.
- Restrict image upload sources to authenticated users where possible to reduce exposure to anonymous network attackers.
Patch Information
The ImageMagick maintainers fixed the off-by-one read in versions 6.9.13-47 and 7.1.2-22. Patch details and commit references are documented in the ImageMagick Security Advisory GHSA-cr6r-hmj8-pr7r. Linux distribution maintainers typically backport these fixes; verify your package manager reflects the patched version.
Workarounds
- Disable the meta encoder in ImageMagick's policy.xml if metadata encoding is not required by the application workflow.
- Reject untrusted images at the application boundary using strict content-type and structural validation before passing them to ImageMagick.
- Run ImageMagick in a sandboxed or containerized environment with minimal privileges to limit any information that adjacent memory could expose.
# Configuration example: restrict ImageMagick coders via policy.xml
# Edit /etc/ImageMagick-7/policy.xml (path varies by distribution)
<policymap>
<policy domain="coder" rights="none" pattern="META" />
</policymap>
# Verify installed ImageMagick version after patching
magick -version | head -n 1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
