CVE-2026-45624: ImageMagick Out-of-Bounds Read in Polynomial Distortion

Technical summary

CVE-2026-45624 is an out-of-bounds read (CWE-125, CWE-129) occurring in ImageMagick's polynomial distortion code path. When certain malformed distortion arguments are supplied—particularly those specifying boundary or coordinate parameters—the affected code fails to validate buffer bounds before reading, resulting in a 24-byte overread. The vulnerability exists in both the 6.9.x legacy and 7.x current release lines. The issue stems from insufficient input validation on distortion coefficients or control point specifications that are passed to the polynomial distortion transform routine.

Business impact

Organizations using ImageMagick in image processing pipelines—including content management systems, automated image optimization services, web photo galleries, and document conversion workflows—face information disclosure risk. While the vulnerability requires local code execution capability to supply malicious distortion parameters, server deployments that process untrusted image files or accept image transformation requests from users are at moderate risk. Exposed memory could contain cached credentials, API keys, or other sensitive data resident in the application process. The MEDIUM severity rating reflects the local attack vector requirement, but the potential for sensitive data leakage warrants prompt patching in production environments.

Affected systems

ImageMagick versions before 6.9.13-47 and 7.1.2-22 are vulnerable. This includes all 6.9.x releases up to 6.9.13-46 and all 7.x releases up to 7.1.2-21. Both source builds and pre-packaged distributions (Linux packages, container images, macOS installations) are affected. Web applications, batch image processors, API services, and integrated systems that embed ImageMagick as a library should be inventoried and assessed for version exposure.

Exploitability

The attack vector is local, meaning an attacker must already have execution context on the target system or be able to supply input to a local image-processing service. The vulnerability does not require special privileges and can be triggered through command-line use or programmatic API calls with crafted polynomial distortion parameters. Remote exploitability is limited to scenarios where a web service or networked application accepts and processes arbitrary image distortion requests without validation. There is no evidence of active exploitation in the wild at this time, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog.

Remediation

Upgrade ImageMagick immediately to version 6.9.13-47 or later (6.9.x series) or 7.1.2-22 or later (7.x series). Most Linux distributions provide package updates through their standard repositories; check your distribution's security advisories for availability. For container deployments, rebuild images from base layers with patched ImageMagick versions. If you maintain custom builds, obtain the latest source from the official ImageMagick repository and recompile. Organizations unable to patch immediately should restrict image distortion features in user-facing applications or limit polynomial distortion usage to trusted, internally generated image parameters.

Patch guidance

Patch availability: Patched versions are 6.9.13-47 and 7.1.2-22 or later. Most users should target the 7.x branch (7.1.2-22+) unless legacy compatibility requires the 6.9.x line. Check your Linux distribution's security bulletin for the exact package version available in your repositories—version numbering may differ from upstream. For containerized workloads, verify the base image maintainer has published an updated layer. Test patched versions in a staging environment before production rollout, particularly if custom ImageMagick compilation flags or policy configurations are in use. Consider scheduling patching within your standard maintenance window given the MEDIUM severity rating and local attack vector requirement.

Detection guidance

Monitor for ImageMagick version inventory across your infrastructure using software composition analysis (SCA) tools or package managers. Log-based detection is limited due to the local attack vector; focus on identifying systems running vulnerable versions through SBOM scans and asset management tools. For runtime detection, monitor ImageMagick process execution with unusual distortion arguments, though this requires deep packet inspection or application-layer logging if the service is exposed over a network. Review access controls on systems where ImageMagick batch jobs or services accept user-supplied image transformation requests; restrict to trusted sources where feasible.

Why prioritize this

While the CVSS score is MEDIUM (5.1) and the vulnerability requires local access or network exposure through a user-facing service, the combination of information disclosure (memory read), broad ImageMagick deployment across image processing infrastructure, and the simplicity of exploitation via crafted polynomial distortion arguments justifies rapid patching. Organizations should prioritize systems that accept untrusted image transformation requests, automated image processing pipelines, and any internet-facing services that offer image resizing or distortion features. Legacy 6.9.x deployments may have extended timelines, but 7.x production systems should be patched within 30 days.

Risk score, explained

The CVSS v3.1 score of 5.1 reflects local attack vector (AV:L), low attack complexity (AC:L), no privilege requirement (PR:N), no user interaction (UI:N), unchanged scope (S:U), low confidentiality impact (C:L), no integrity impact (I:N), and low availability impact (A:L). The score appropriately captures the information disclosure risk while acknowledging the local-only attack surface. However, organizations operating web-facing image services or accepting remote distortion requests should treat this with urgency, as the network exposure in such deployments elevates practical risk above the base score.

Frequently asked questions