CVE-2026-45359

What it actually does

This vulnerability is a heap buffer over-read in ImageMagick's connected components image-processing operation when an invalid connected-components:keep-top value is supplied. A crafted image-processing request or command path that exercises this option can cause ImageMagick to read memory outside the intended heap buffer. The primary technical risk is unintended memory disclosure from the ImageMagick process, with a secondary risk of process instability or crash. The CVSS vector indicates local attack characteristics and high attack complexity, but in practice exposure can become remotely reachable when ImageMagick is invoked by web applications, document conversion services, media pipelines, CI jobs, or other automation that processes attacker-supplied images or transformation options.

Why it matters to the business

Organizations using ImageMagick in image upload, thumbnailing, document conversion, media processing, or automated content workflows could face leakage of sensitive process memory or service disruption if untrusted inputs can trigger the vulnerable connected components operation. The public exploitation probability is currently low, EPSS is very low, it is not listed in CISA KEV, and no mature public exploit is indicated; however, ImageMagick is widely embedded in downstream applications and backend processing services, so patching should still be prioritized for internet-facing or multi-tenant processing environments.

How an attack unfolds

An attacker first identifies an application, service, script, or batch workflow that invokes ImageMagick prior to versions 6.9.13-48 or 7.1.2-22. The attacker then submits or causes processing of image content or image-processing parameters that reach the connected components operation with a malformed or invalid connected-components:keep-top value. When ImageMagick performs the connected components calculation, the invalid value can cause a heap buffer over-read. Depending on process layout and how output, errors, or transformed data are returned, the attacker may be able to infer or recover memory contents from the process, or cause the worker process to crash. Successful exploitation generally requires that the vulnerable operation is reachable and that attacker-controlled input or options are passed into ImageMagick, which makes exploitation more likely in custom conversion pipelines than in default installations that do not expose this operation.

How to fix it

Upgrade ImageMagick to a patched release: 6.9.13-48 or later for the 6.x branch, or 7.1.2-22 or later for the 7.x branch. Also update packaged copies bundled inside container images, language-specific wrappers, desktop applications, document conversion tools, and media-processing services. Where immediate patching is not possible, restrict ImageMagick usage to trusted inputs, prevent user-controlled transformation arguments, disable or block workflows that invoke connected components processing, run ImageMagick in a sandboxed low-privilege context, apply resource limits, and isolate media processing workers from sensitive secrets and internal services.

How to confirm the fix worked

Confirm the deployed ImageMagick version with commands such as `magick -version`, `convert -version`, or package manager inventory, and verify it reports 6.9.13-48 or later for ImageMagick 6.x, or 7.1.2-22 or later for ImageMagick 7.x. Validate all runtime locations, including containers, serverless images, build agents, worker hosts, and application bundles, because multiple ImageMagick binaries may coexist. Review application code and job definitions for use of `connected-components` and `connected-components:keep-top`. After upgrading, rerun representative image-processing workflows and confirm malformed connected-components options no longer crash the process or produce sanitizer findings. For exposure validation, ensure untrusted users cannot provide raw ImageMagick command-line options or policy-controlled operations.

Typical attack path

1. Identify an application, API, upload workflow, or automation pipeline that uses ImageMagick for image manipulation.
2. Determine whether the environment is running ImageMagick before 6.9.13-48 or 7.1.2-22.
3. Find a path where attacker-supplied images or transformation arguments can influence connected components processing.
4. Submit crafted input using an invalid connected-components:keep-top value.
5. Trigger ImageMagick to execute the connected components operation.
6. Observe output, errors, crashes, memory disclosure behavior, or service instability.
7. Repeat with adjusted input if attempting to extract useful memory or cause reliable denial of service.

How to detect it

To determine whether exploitation was already attempted, review logs from applications, upload services, media-processing workers, document conversion systems, CI jobs, and container platforms that invoke ImageMagick. Look for requests or job parameters containing `connected-components` or `connected-components:keep-top`, especially malformed, negative, extremely large, nonnumeric, repeated, or unusual values. Review process supervisor logs, system logs, container logs, and crash reports for `magick`, `convert`, or ImageMagick worker crashes around image-processing requests. If AddressSanitizer, crash dumps, EDR memory protections, or kernel logs are available, search for heap-buffer-over-read findings or segmentation faults associated with ImageMagick. Correlate suspicious image upload events with immediate ImageMagick crashes, 5xx responses, worker restarts, core dumps, or abnormal output sizes. Because this vulnerability is a memory over-read rather than a code-execution issue, durable host IOCs may be limited; detection should focus on exploit-shaped parameters, crashes, sanitizer output, and suspicious processing activity.

• connected-components:keep-top
• -connected-components
• connected-components
• heap-buffer-over-read
• AddressSanitizer: heap-buffer-over-read
• magick
• convert
• ImageMagick
• ConnectedComponentsImage
• Segmentation fault
• core dumped

What your security team should do

• Inventory all ImageMagick installations and embedded copies across servers, containers, developer tooling, CI/CD jobs, and media-processing applications.
• Prioritize upgrades on internet-facing, upload-facing, multi-tenant, or automated processing systems that handle untrusted images or user-controlled transformation options.
• Upgrade to ImageMagick 6.9.13-48 or later, or 7.1.2-22 or later, and rebuild/redeploy dependent containers and application packages.
• Search application code, scripts, and job definitions for `connected-components` and `connected-components:keep-top` usage to identify reachable attack paths.
• Block user-supplied ImageMagick command-line arguments and enforce allowlists for permitted image operations.
• Run ImageMagick with least privilege, sandboxing, temporary-directory isolation, and strict CPU, memory, file, and timeout limits.
• Monitor for ImageMagick worker crashes, abnormal error rates, and logs referencing connected components processing.
• If suspected exploitation occurred, rotate secrets that may have been resident in the affected process memory and review adjacent application logs for suspicious upload or processing activity.