CVE-2026-45359: ImageMagick Buffer Overflow Vulnerability

CVE-2026-45359 Overview

CVE-2026-45359 is a heap buffer over-read vulnerability in ImageMagick, the open-source image manipulation library. The flaw resides in the connected components operation when processing an invalid connected-components:keep-top value. An attacker who supplies a crafted parameter to a vulnerable ImageMagick instance can trigger an out-of-bounds read on the heap, leading to information disclosure or process termination. The issue is tracked under [CWE-125] (Out-of-Bounds Read) and affects ImageMagick versions prior to 6.9.13-48 and 7.1.2-22.

Critical Impact
Local attackers can trigger a heap buffer over-read by supplying an invalid connected-components:keep-top argument, potentially exposing process memory or causing denial of service.

Affected Products

ImageMagick versions prior to 6.9.13-48 (6.x branch)
ImageMagick versions prior to 7.1.2-22 (7.x branch)
Applications and services that embed vulnerable ImageMagick releases for image processing

Discovery Timeline

2026-06-10 - CVE-2026-45359 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-45359

Vulnerability Analysis

The vulnerability occurs in ImageMagick's connected components labeling routine. This operation groups adjacent pixels that share the same intensity and supports a keep-top filter to retain the largest N components by area. When the caller supplies an invalid value for connected-components:keep-top, the parser fails to validate the bound before indexing the components array. The result is a read past the end of a heap-allocated buffer.

Because ImageMagick is frequently invoked by web services, document converters, and content pipelines, any process that accepts user-controlled image processing arguments inherits this exposure. The over-read can leak adjacent heap memory or crash the worker, depending on allocator state.

Root Cause

The root cause is missing bounds validation on the connected-components:keep-top argument before it is used as an index or length. ImageMagick treats the value as trusted input rather than clamping it against the actual count of detected components. The maintainers patched the issue in 6.9.13-48 and 7.1.2-22 by adding input validation on the keep-top parameter. Refer to the GitHub Security Advisory GHSA-vhrh-72hq-w8m7 for the upstream fix.

Attack Vector

Exploitation requires local access with the ability to pass arguments to ImageMagick, such as via the magick or convert command line, the MagickWand or MagickCore APIs, or an embedding application that forwards user-controlled options. The attacker invokes the connected components operator with an invalid keep-top value to drive the read past the buffer boundary.

No verified public exploit code is available. The vulnerability mechanism is documented in the upstream security advisory; consult that reference for technical specifics rather than synthetic proof-of-concept code.

Detection Methods for CVE-2026-45359

Indicators of Compromise

ImageMagick worker processes (magick, convert, identify) terminating with SIGSEGV or SIGABRT during connected-components operations.
Image processing jobs that include -define connected-components:keep-top= arguments with unusually large, negative, or non-numeric values.
Repeated crashes in services such as web image uploaders, thumbnail generators, or document converters that invoke ImageMagick.

Detection Strategies

Inventory ImageMagick installations and flag any version below 6.9.13-48 (6.x) or 7.1.2-22 (7.x).
Audit application logs and command histories for use of the connected-components operator with the keep-top define.
Enable AddressSanitizer or equivalent heap instrumentation in non-production builds to surface out-of-bounds reads during fuzzing.

Monitoring Recommendations

Alert on abnormal termination of ImageMagick child processes spawned by web servers, queue workers, or document pipelines.
Capture and review command lines passed to ImageMagick binaries through endpoint telemetry and process auditing tools such as auditd or Sysmon.
Track outbound data volume from image-processing hosts to identify potential memory disclosure abuse.

How to Mitigate CVE-2026-45359

Immediate Actions Required

Upgrade ImageMagick to 6.9.13-48 or 7.1.2-22 or later on every host, container image, and build pipeline.
Rebuild and redeploy any application that statically links against ImageMagick or bundles the library inside container images.
Restrict which ImageMagick -define options users can supply through application-layer allow-lists.

Patch Information

The ImageMagick maintainers released fixed builds in versions 6.9.13-48 and 7.1.2-22. The patch validates the connected-components:keep-top value before it is used to access the components array. Patch details and source diffs are available in the GitHub Security Advisory GHSA-vhrh-72hq-w8m7.

Workarounds

Disable or block use of the connected-components morphology operator if it is not required by your workflow.
Reject user-supplied -define arguments at the application boundary and only allow a fixed set of vetted operations.
Run ImageMagick inside a sandbox or seccomp-restricted container so that a successful over-read cannot escalate beyond the worker process.

bash

# Example: restrict ImageMagick policy to disable the connected-components operator
# /etc/ImageMagick-7/policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="EPHEMERAL" />
  <policy domain="filter" rights="none" pattern="ConnectedComponents" />
</policymap>