CVE-2026-45359
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk2th percentile — higher than 2% of all known CVEs
Summary
In ImageMagick prior to versions 6.9.13-48 and 7.1.2-22, an invalid connected-components:keep-top value could result in a heap buffer over-read when performing the connected components operation.
Risk Assessment
This vulnerability could allow an attacker to read sensitive memory data or cause application crashes, posing a risk to system confidentiality and availability.
Recommendation
Immediately update ImageMagick to version 6.9.13-48 or 7.1.2-22, which contain the fix for this vulnerability.
Original NVD description (English source)
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-22, an invalid connected-components:keep-top value could result in a heap buffer over-read when performing the connected components operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-22.