NetSight
IP …
medium5.7

CVE-2026-45359

ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define

Impact

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-22, an invalid connected-components:keep-top value could result in a heap buffer over-read when performing the connected components operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-22.

Affected packages

EcosystemPackageAffectedFixed in
nugetMagick.NET-Q16-AnyCPU< 14.13.114.13.1
nugetMagick.NET-Q16-HDRI-AnyCPU< 14.13.114.13.1
nugetMagick.NET-Q16-HDRI-OpenMP-arm64< 14.13.114.13.1
nugetMagick.NET-Q16-HDRI-OpenMP-x64< 14.13.114.13.1
nugetMagick.NET-Q16-HDRI-arm64< 14.13.114.13.1
nugetMagick.NET-Q16-HDRI-x64< 14.13.114.13.1
nugetMagick.NET-Q16-HDRI-x86< 14.13.114.13.1
nugetMagick.NET-Q16-OpenMP-arm64< 14.13.114.13.1
nugetMagick.NET-Q16-OpenMP-x64< 14.13.114.13.1
nugetMagick.NET-Q16-arm64< 14.13.114.13.1
nugetMagick.NET-Q16-x64< 14.13.114.13.1
nugetMagick.NET-Q16-x86< 14.13.114.13.1
nugetMagick.NET-Q8-AnyCPU< 14.13.114.13.1
nugetMagick.NET-Q8-OpenMP-arm64< 14.13.114.13.1
nugetMagick.NET-Q8-OpenMP-x64< 14.13.114.13.1
nugetMagick.NET-Q8-arm64< 14.13.114.13.1
nugetMagick.NET-Q8-x64< 14.13.114.13.1
nugetMagick.NET-Q8-x86< 14.13.114.13.1

Affected products

VendorProductAffected versions
ImagemagickImagemagick
before 6.9.13-48
from 7.0.0-0 before 7.1.2-22

Weakness classification

CWE-125CWE-129

References