CVE-2026-45358

What it actually does

This vulnerability is an off-by-one memory access bug in ImageMagick's META encoder before ImageMagick 6.9.13-47 and 7.1.2-22. When ImageMagick processes specially crafted image content or metadata through the affected encoder path, it can read one byte beyond the intended buffer boundary. The primary technical consequence is low-impact information disclosure: a single adjacent byte of process memory may be exposed through encoder output or observable behavior. The published scoring does not indicate integrity impact, code execution, privilege escalation, or reliable denial of service.

Why it matters to the business

Organizations that use ImageMagick in web applications, media pipelines, document conversion services, thumbnail generators, CMS platforms, or user-upload workflows may expose small amounts of process memory when handling maliciously crafted images. The practical business risk is limited compared with remote code execution flaws, but ImageMagick is commonly embedded in many downstream products and automated processing services, so exposure may be widespread and difficult to inventory. The CVSS score is moderate, EPSS is low, it is not listed in CISA KEV, and no public exploit maturity is reported, so remediation should be prioritized as routine security maintenance unless ImageMagick processes untrusted external uploads at scale.

How an attack unfolds

An attacker first identifies an application or service that accepts images or documents and processes them with a vulnerable ImageMagick version. The attacker crafts an image or metadata payload intended to reach the META encoder code path, typically by causing the application to convert, inspect, transform, or export image data using ImageMagick. When the vulnerable encoder processes the malformed boundary condition, it reads one byte past the end of an internal buffer. If the application returns the encoded output or exposes processing results, the attacker may be able to infer or recover a single byte of adjacent process memory. Exploitation is expected to be highly constrained because the bug is an out-of-bounds read of only one byte and there is no indication of code execution or persistent compromise.

How to fix it

Upgrade ImageMagick to a fixed release: 6.9.13-47 or later for the 6.x branch, or 7.1.2-22 or later for the 7.x branch. Where ImageMagick is bundled inside operating system packages, containers, language libraries, desktop applications, CMS plugins, or document/media processing products, update the vendor-provided package rather than only checking the standalone binary. Rebuild and redeploy containers or application images that include vulnerable ImageMagick libraries. If immediate upgrade is not possible, reduce exposure by disabling processing of untrusted image uploads, blocking conversion to or from META-related formats where feasible, applying ImageMagick policy.xml restrictions for unnecessary coders, sandboxing image conversion workers, and ensuring conversion services run with minimal privileges and no access to sensitive secrets.

How to confirm the fix worked

Confirm the installed ImageMagick version reports 6.9.13-47 or later, or 7.1.2-22 or later, using package manager metadata and the `magick -version` or `convert -version` output as applicable. Validate all runtime locations, including application containers, serverless images, CI build images, desktop packages, and embedded dependencies, because multiple ImageMagick copies can coexist. Confirm the active process is using the patched library by restarting dependent services and checking loaded package versions after deployment. For exposure validation, review whether any externally supplied files can reach ImageMagick conversion or metadata encoding paths; if they can, treat those workflows as exposed until patched or isolated. Regression testing should include representative image upload, thumbnailing, conversion, and metadata workflows to verify the upgrade did not break business-critical media processing.

Typical attack path

1. Find an internet-facing or otherwise reachable service that processes user-supplied images using ImageMagick.
2. Determine or guess that the service uses a vulnerable ImageMagick release earlier than 6.9.13-47 or 7.1.2-22.
3. Submit a specially crafted image or metadata payload designed to trigger the META encoder boundary condition.
4. Cause the service to convert, encode, inspect, or export the file through the affected ImageMagick code path.
5. Observe the returned encoded output, application response, or processing behavior for evidence of a one-byte out-of-bounds memory disclosure.
6. Repeat with variations only if the application exposes enough output to make the leaked byte observable.

How to detect it

There are no unique public indicators that reliably prove exploitation of this vulnerability. Retrospective detection should focus on services that accept untrusted image or document uploads and invoke ImageMagick. Review web, API, object-storage, message-queue, and media-processing logs for unusual files submitted shortly before ImageMagick errors, especially repeated conversion attempts, files with abnormal metadata, or requests that trigger META encoding/export behavior. Check application logs, worker logs, and system journals for ImageMagick warnings, memory-safety sanitizer reports, or crashes involving `magick`, `convert`, `identify`, MagickCore, MagickWand, or META coder paths. If centralized file retention is available, preserve suspicious uploaded samples and analyze them in an isolated patched and instrumented environment. In containerized deployments, review historical container stdout/stderr logs and crash/restart events for image-processing workers. Since the known impact is a one-byte out-of-bounds read rather than code execution, absence of crashes or persistence artifacts does not rule out attempted exploitation, and successful exploitation may leave only normal upload and conversion traces.

What your security team should do

• Inventory all systems, containers, applications, and third-party products that include ImageMagick or call `magick`, `convert`, `identify`, or linked MagickCore/MagickWand libraries.
• Prioritize patching services that process untrusted external uploads, email attachments, web-submitted images, documents, or media files.
• Upgrade to ImageMagick 6.9.13-47 or later, or 7.1.2-22 or later, and rebuild any dependent container images or application artifacts.
• Apply defense-in-depth controls for image processing: sandbox workers, restrict network and filesystem access, run as non-privileged users, and limit accessible secrets in the process environment.
• Use ImageMagick policy controls to disable unneeded coders and file formats, especially in services that only require basic thumbnailing or format conversion.
• Monitor image-processing error logs and upload activity for malformed or unusual image files submitted repeatedly from the same source.
• Because this issue is not in CISA KEV, has low EPSS, and has no reported mature exploit, handle it through standard patch cycles unless high-risk untrusted upload paths are present.