Executive brief
ImageMagick is a widely used open-source tool for editing and converting digital images. A flaw in how it handles specific image processing commands could allow an attacker to read sensitive information from the computer's memory or cause the application to crash. This could lead to data exposure or service disruptions in environments that process user-supplied images.
Technical details
A heap buffer over-read vulnerability exists in ImageMagick's connected components operation due to improper validation of the 'connected-components:keep-top' value. The root cause is a failure to properly validate array indices (CWE-129), leading to an out-of-bounds read (CWE-125). An attacker with local access could exploit this by providing a specially crafted value to the image processing routine. Successful exploitation could allow the attacker to read sensitive data from the heap or cause a denial-of-service (DoS) through an application crash. The issue is resolved in versions 6.9.13-48 and 7.1.2-22.
Affected products
- ImageMagick ImageMagick < 6.9.13-48, < 7.1.2-22
Timeline
- 2026-05-16: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE published to NVD