CVE-2026-45624 Overview
CVE-2026-45624 is an out-of-bounds read vulnerability in ImageMagick, the widely deployed open-source image processing library. The flaw resides in the polynomial distortion routine, where specifically crafted arguments trigger a 24-byte over-read beyond an allocated buffer. Versions prior to 6.9.13-47 and 7.1.2-22 are affected.
The ImageMagick maintainers patched the issue in releases 6.9.13-47 and 7.1.2-22. The vulnerability is categorized under CWE-125 (Out-of-Bounds Read) and requires local access to exploit.
Critical Impact
Attackers with local access can trigger a 24-byte out-of-bounds read during polynomial distortion processing, potentially leaking adjacent memory contents or crashing the process.
Affected Products
- ImageMagick versions prior to 6.9.13-47 (6.x branch)
- ImageMagick versions prior to 7.1.2-22 (7.x branch)
- Applications and services embedding vulnerable ImageMagick builds for image processing
Discovery Timeline
- 2026-06-10 - CVE-2026-45624 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-45624
Vulnerability Analysis
The vulnerability occurs in ImageMagick's polynomial distortion implementation. When the function processes user-supplied distortion arguments, it reads 24 bytes beyond the bounds of an allocated buffer. This out-of-bounds read can expose adjacent heap or stack memory contents to the caller, depending on how the distorted image data is rendered or returned.
Polynomial distortion is invoked through the -distort Polynomial command-line option and the corresponding DistortImage() API. The routine accepts a coefficient list whose length must match a specific polynomial order. When the argument count does not align with the expected layout, indexing logic dereferences memory past the allocated coefficient array.
The issue impacts confidentiality and availability at a limited scope. Memory disclosure is bounded to 24 bytes per invocation, but repeated calls in a service context can leak meaningful adjacent data. Process crashes occur when the over-read crosses an unmapped page boundary.
Root Cause
The root cause is insufficient validation of the argument vector length against the polynomial order requested by the caller. The function trusts the supplied argument count and reads coefficients past the allocated buffer. The patch in 6.9.13-47 and 7.1.2-22 adds bounds checks before each coefficient read.
Attack Vector
Exploitation requires local access and the ability to pass attacker-controlled arguments to ImageMagick. This includes command-line invocation through convert or magick, scripted pipelines, and applications that forward untrusted user input into distortion APIs. No authentication or user interaction is required beyond the ability to invoke the vulnerable code path. See the GitHub Security Advisory GHSA-pfvh-m9xv-8966 for additional technical detail.
Detection Methods for CVE-2026-45624
Indicators of Compromise
- ImageMagick process crashes or segmentation faults referencing DistortImage or polynomial distortion code paths
- Unexpected -distort Polynomial invocations in shell history, web server logs, or image processing job queues
- Anomalous memory contents appearing in rendered output images from automated pipelines
Detection Strategies
- Inventory installed ImageMagick versions across endpoints and servers, flagging builds below 6.9.13-47 and 7.1.2-22
- Monitor process telemetry for magick, convert, or library consumers that invoke distortion operations with abnormal argument lists
- Review application logs for ImageMagick error output indicating malformed distortion parameters
Monitoring Recommendations
- Enable crash reporting on systems running ImageMagick to capture out-of-bounds read signals
- Audit web applications and SaaS pipelines that accept user-supplied image transformation parameters
- Track package manager events for ImageMagick upgrades to confirm patched versions are deployed
How to Mitigate CVE-2026-45624
Immediate Actions Required
- Upgrade ImageMagick to version 6.9.13-47 or 7.1.2-22 on all affected systems
- Identify applications and containers bundling ImageMagick as a dependency and rebuild with the patched release
- Restrict the ability of untrusted users to pass arbitrary -distort arguments to ImageMagick utilities
Patch Information
The vulnerability is fixed in ImageMagick 6.9.13-47 and 7.1.2-22. Source releases and binary packages are available through the upstream project and downstream distribution maintainers. Refer to the ImageMagick Security Advisory GHSA-pfvh-m9xv-8966 for fix details.
Workarounds
- Disable polynomial distortion operations in policy.xml until patches are applied
- Sanitize and validate distortion coefficient arguments before passing them to ImageMagick APIs
- Run ImageMagick under a restricted user account with seccomp or AppArmor profiles to contain memory disclosure impact
# Restrict distortion in /etc/ImageMagick-7/policy.xml
<policy domain="filter" rights="none" pattern="Distort" />
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
