Magick.NET CVE-2026-45359

Magick.NET is a .NET wrapper library around the ImageMagick image processing engine, distributed across multiple NuGet package variants differentiated by color depth (Q16, Q16-HDRI), threading model (OpenMP), and CPU architecture (AnyCPU, x64, arm64, x86). The connected components operation segments an image into labeled regions; the connected-components:keep-top define is a user-supplied parameter that controls how many top components are retained. CWE-125 (Out-of-bounds Read) identifies the root cause: the library fails to validate this parameter before using it to index into a heap-allocated buffer, permitting a read beyond the buffer's allocated bounds. The over-read occurs on the heap - a more controlled memory region than the stack - making reliable arbitrary-offset reads feasible depending on heap layout, which can leak sensitive in-process data (e.g., keys, tokens, adjacent image data). The CVSS vector AV:L confirms the triggering input must reach the process locally (e.g., via a file path or piped input on the same host), while AC:H indicates exploitation requires favorable heap-layout conditions, reducing repeatability.