PatchSiren cyber security CVE debrief
CVE-2026-45359 ImageMagick CVE debrief
CVE-2026-45359 is a medium-severity vulnerability in ImageMagick, a free and open-source software for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-22, an invalid connected-components:keep-top value could result in a heap buffer over-read when performing the connected components operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-22.
- Vendor
- ImageMagick
- Product
- Unknown
- CVSS
- MEDIUM 5.7
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-10
- Original CVE updated
- 2026-06-11
- Advisory published
- 2026-06-10
- Advisory updated
- 2026-06-11
Who should care
Users of ImageMagick versions prior to 6.9.13-48 and 7.1.2-22 should apply the patches to prevent potential heap buffer over-read attacks.
Technical summary
The vulnerability exists in the connected components operation of ImageMagick. An invalid connected-components:keep-top value can lead to a heap buffer over-read. The CVSS score for this vulnerability is 5.7, indicating a medium severity.
Defensive priority
Medium
Recommended defensive actions
- Update to ImageMagick version 6.9.13-48 or later
- Update to ImageMagick version 7.1.2-22 or later
Evidence notes
The CVE-2026-45359 vulnerability was published on [cve-org](https://www.cve.org/CVERecord?id=CVE-2026-45359) and has a detailed analysis on [nvd](https://nvd.nist.gov/vuln/detail/CVE-2026-45359).
Official resources
-
CVE-2026-45359 CVE record
CVE.org
-
CVE-2026-45359 NVD detail
NVD
-
Source item URL
nvd_modified
-
Mitigation or vendor reference
[email protected] - Vendor Advisory
CVE-2026-45359 was published on 2026-06-10T22:16:58.070Z and modified on 2026-06-11T18:41:39.570Z.