Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-10T21:26:32 ImageMagick: ImageMagick: Information Disclosure via Invalid Connected-Components Value 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CWE-125

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-22, an invalid connected-components:keep-top value could result in a heap buffer over-read when performing the connected components operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-22.

A flaw was found in ImageMagick. A local attacker could exploit this vulnerability by providing an invalid 'connected-components:keep-top' value during image processing. This could lead to a heap buffer over-read, potentially resulting in information disclosure or a denial of service (DoS).

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Enterprise Linux 6 Out of support scope ImageMagick Red Hat Enterprise Linux 7 Not affected ImageMagick https://www.cve.org/CVERecord?id=CVE-2026-45359 https://nvd.nist.gov/vuln/detail/CVE-2026-45359 https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vhrh-72hq-w8m7