Magick.NET CVE-2026-45624

Magick.NET is the .NET wrapper library for ImageMagick, distributed via NuGet in multiple build variants targeting different architectures (AnyCPU, arm64, x64, x86) and quantum depths (Q16, Q16-HDRI, with optional OpenMP acceleration). The vulnerable code path resides in the polynomial distortion operation, where insufficient bounds checking on caller-supplied arguments allows a read of up to 24 bytes beyond the end of an allocated heap buffer - classified as CWE-125 (Out-of-bounds Read). The GHSA advisory headline refers to a 'Heap Buffer Over-Read of 4 bytes' while the CVE description and advisory body specify 24 bytes; this discrepancy may reflect different measurement points or a title error in the advisory. The over-read can expose adjacent heap contents (information disclosure) or, depending on heap layout, dereference unmapped memory and crash the process (availability impact). All ten NuGet package variants listed in the CPE data share the same underlying ImageMagick distortion code and are equally affected.