CVE-2026-45624

What it actually does

This flaw is an out-of-bounds memory over-read in ImageMagick's polynomial distortion handling. When ImageMagick processes a crafted polynomial distortion operation with specific arguments, it can read 24 bytes beyond the intended memory boundary. The most likely technical outcomes are process crash, abnormal termination, or limited unintended memory disclosure from the ImageMagick process. The vulnerability does not provide direct code execution based on the available details, and the CVSS vector indicates low confidentiality impact and low availability impact with no integrity impact.

Why it matters to the business

Organizations that use ImageMagick in image-processing pipelines, document conversion workflows, media upload services, thumbnail generation, or automated content handling may experience service instability or limited exposure of process memory if untrusted input can influence ImageMagick distortion operations. The risk is moderate rather than critical because exploitation requires a specific image-processing operation and there is no known public exploit or CISA KEV listing, but ImageMagick is widely embedded in downstream applications and services, so exposure can be indirect through third-party packages or application features.

How an attack unfolds

An attacker needs a path to make ImageMagick execute a polynomial distortion operation using attacker-controlled or otherwise malformed parameters. In a local scenario, this could be done by invoking ImageMagick directly with crafted command-line arguments. In an application scenario, exploitation depends on whether an exposed service allows users to upload files or request transformations that are ultimately passed to ImageMagick with polynomial distortion enabled. When the vulnerable code path is reached, ImageMagick reads 24 bytes past the expected memory region. This may crash the process, cause failed image processing, or expose small amounts of adjacent process memory through errors, output differences, or diagnostic behavior, depending on how the calling application handles failures and responses.

How to fix it

Upgrade ImageMagick to a patched release: version 6.9.13-47 or later for the 6.x branch, or version 7.1.2-22 or later for the 7.x branch. Where ImageMagick is bundled inside operating system packages, containers, language libraries, or application appliances, apply the vendor-provided security update rather than only updating a standalone binary. If immediate patching is not possible, reduce exposure by preventing untrusted users from controlling ImageMagick transformation arguments, disabling or restricting polynomial distortion operations, running image-processing jobs in a sandboxed low-privilege environment, enforcing resource limits, and isolating image processing from sensitive application memory and secrets.

How to confirm the fix worked

Confirm the installed ImageMagick version reports 6.9.13-47 or later, or 7.1.2-22 or later, using commands such as `magick -version`, `convert -version`, or package-manager queries. Validate that all runtime locations, containers, build images, and application bundles use the patched library and are not still loading an older shared library. Review application code and job workers to identify use of `-distort Polynomial` or equivalent API calls. Where safe and authorized, run regression tests for image transformations that use polynomial distortion and confirm they complete without crashes, sanitizer findings, or abnormal memory errors. For externally exposed upload or transformation services, confirm that users cannot supply arbitrary ImageMagick command-line options or distortion coefficients unless strictly validated.

Typical attack path

1. Identify an application, service, or workflow that uses ImageMagick for image manipulation.
2. Determine whether the workflow allows attacker-controlled image transformation parameters or reaches the polynomial distortion feature internally.
3. Submit or invoke a crafted polynomial distortion operation with arguments that trigger the out-of-bounds over-read.
4. Observe whether the ImageMagick process crashes, returns an error, leaks anomalous output, or causes the parent service to fail.
5. Repeat with adjusted parameters if attempting to cause reliable denial of service or infer process memory behavior.

How to detect it

Look for evidence that ImageMagick processed polynomial distortion operations shortly before crashes, worker restarts, segmentation faults, sanitizer alerts, or abnormal image-processing errors. Relevant sources include application logs from upload and transformation services, web access logs for image-processing endpoints, job queue logs, container stdout/stderr, systemd journal entries, crash dumps, core dumps, EDR process telemetry, and package/runtime version inventories. Focus on invocations of `magick` or `convert` containing `-distort Polynomial`, repeated failures tied to the same source user or IP, and memory-safety error messages such as out-of-bounds reads or AddressSanitizer findings. Since no specific public exploit or threat actor activity is known, absence of these artifacts does not prove non-exploitation, but repeated crafted distortion attempts or correlated crashes should be investigated.

• -distort Polynomial
• distort Polynomial
• Polynomial distortion
• magick -distort Polynomial
• convert -distort Polynomial
• AddressSanitizer: heap-buffer-overflow
• AddressSanitizer: global-buffer-overflow
• AddressSanitizer: stack-buffer-overflow
• out-of-bounds read
• out of bounds read
• OOB read
• Segmentation fault
• SIGSEGV
• core dumped
• MagickCore
• MagickWand
• Polynomial

What your security team should do

• Inventory ImageMagick usage across servers, containers, CI/CD images, desktop tooling, and applications that perform image or document conversion.
• Prioritize patching internet-facing upload, media processing, thumbnailing, and document conversion services that process untrusted content or user-supplied transformation parameters.
• Upgrade to ImageMagick 6.9.13-47 or later, or 7.1.2-22 or later, through trusted vendor packages or rebuilt application images.
• Search code, configuration, and job definitions for polynomial distortion usage, especially `-distort Polynomial`, and restrict untrusted control over those parameters.
• Run ImageMagick under least privilege with sandboxing, seccomp/AppArmor/SELinux where available, temporary-directory isolation, and memory/CPU/time limits.
• Monitor for crashes or repeated processing failures involving polynomial distortion, particularly from unauthenticated or low-trust users.
• Because there is no known public exploit maturity and the EPSS score is low, treat this as a hygiene and exposure-reduction priority rather than an emergency response item unless the feature is directly exposed to untrusted input.