CVE-2026-22770: ImageMagick Use-After-Free Vulnerability

CVE-2026-22770 Overview

ImageMagick, the widely-used open-source software for editing and manipulating digital images, contains a memory management vulnerability in versions prior to 7.1.2-13. The BilateralBlurImage method allocates a set of double buffers inside AcquireBilateralTLS, but the last element in the set is not properly initialized. This flaw results in the release of an invalid pointer inside DestroyBilateralTLS when memory allocation fails, potentially leading to denial of service or memory corruption.

Critical Impact
Improper initialization of memory buffers can lead to invalid pointer release, causing application crashes or potential memory corruption when processing maliciously crafted images.

Affected Products

ImageMagick versions prior to 7.1.2-13

Discovery Timeline

2026-01-20 - CVE CVE-2026-22770 published to NVD
2026-01-20 - Last updated in NVD database

Technical Details for CVE-2026-22770

Vulnerability Analysis

This vulnerability is classified as CWE-763: Release of Invalid Pointer or Reference. The root issue lies in the AcquireBilateralTLS function within MagickCore/effect.c, where memory buffers are allocated for bilateral blur operations. The code uses memset to initialize the weights array, but the initialization only covers number_threads elements instead of number_threads+1 elements, leaving the last entry uninitialized.

When a subsequent memory allocation fails during the loop that populates these buffers, the DestroyBilateralTLS cleanup function is called. This function attempts to free all pointers in the array, including the uninitialized last element, which contains an undefined value rather than NULL. Attempting to free this invalid pointer leads to undefined behavior, typically manifesting as a crash or potential memory corruption.

The vulnerability requires an attacker to trigger a memory allocation failure condition, which can be achieved through resource exhaustion or by processing specially crafted images that cause extreme memory demands during bilateral blur operations.

Root Cause

The root cause is an off-by-one error in the memset call within AcquireBilateralTLS. The weights array is allocated with number_threads+1 elements, but the subsequent memset only initializes number_threads elements, leaving the final pointer uninitialized. When cleanup is triggered by an allocation failure, the uninitialized pointer is passed to the memory deallocation routine.

Attack Vector

The attack vector is network-based with high complexity. An attacker can exploit this vulnerability by:

Submitting a specially crafted image to a server running ImageMagick
Triggering the bilateral blur operation through image processing requests
Causing memory allocation failures through resource exhaustion or specific image parameters
Exploiting the invalid pointer release during error cleanup

The vulnerability is particularly relevant in web applications that use ImageMagick for server-side image processing.

   double
     **weights;
 
+  size_t
+    count;
+
   ssize_t
     i;
 
+  if (HeapOverflowSanityCheckGetSize(height,sizeof(**weights),&count) != MagickFalse)
+    return((double **) NULL);
   weights=(double **) AcquireQuantumMemory(number_threads+1,sizeof(*weights));
   if (weights == (double **) NULL)
     return((double **) NULL);
-  (void) memset(weights,0,number_threads*sizeof(*weights));
+  (void) memset(weights,0,(number_threads+1)*sizeof(*weights));
   for (i=0; i <= (ssize_t) number_threads; i++)
   {
-    weights[i]=(double *) AcquireQuantumMemory(width,height*sizeof(**weights));
+    weights[i]=(double *) AcquireQuantumMemory(width,count);
     if (weights[i] == (double *) NULL)
       return(DestroyBilateralTLS(number_threads,weights));
   }

Source: GitHub Commit Reference

The patch corrects the memset to initialize all number_threads+1 elements and adds a heap overflow sanity check for the size calculation.

Detection Methods for CVE-2026-22770

Indicators of Compromise

Unexpected ImageMagick crashes or segmentation faults during bilateral blur operations
Memory corruption errors in system logs related to ImageMagick processes
Abnormal memory allocation patterns preceding application failures
Core dumps indicating invalid pointer access in DestroyBilateralTLS

Detection Strategies

Monitor ImageMagick processes for crash events, particularly those involving effect.c or bilateral blur functions
Implement application-level logging for memory allocation failures in image processing workflows
Use memory debugging tools like Valgrind or AddressSanitizer to detect invalid pointer operations
Review system logs for repeated ImageMagick process restarts indicating exploitation attempts

Monitoring Recommendations

Enable crash reporting and analyze core dumps for patterns matching this vulnerability
Monitor resource utilization to detect potential memory exhaustion attacks targeting this flaw
Implement anomaly detection for unusual image processing requests that may trigger the vulnerability
Set up alerts for ImageMagick segmentation faults in production environments

How to Mitigate CVE-2026-22770

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-13 or later immediately
Audit systems for vulnerable ImageMagick installations using version checks
Review image processing workflows for exposure to untrusted input
Consider implementing resource limits on ImageMagick processes as a defense-in-depth measure

Patch Information

The vulnerability has been addressed in ImageMagick version 7.1.2-13. The fix corrects the memset initialization to properly cover all allocated elements and adds a heap overflow sanity check. The patch is available via the GitHub commit. For complete details, refer to the GitHub Security Advisory GHSA-39h3-g67r-7g3c.

Workarounds

Restrict ImageMagick to process only trusted image sources if immediate patching is not possible
Implement memory resource limits using ImageMagick policy configuration
Disable or restrict bilateral blur operations through policy.xml if not required
Use containerization to isolate ImageMagick processes and limit blast radius

bash

# Configuration example - ImageMagick policy.xml resource limits
# Add to /etc/ImageMagick-7/policy.xml

# Limit memory usage to reduce attack surface
# <policy domain="resource" name="memory" value="256MiB"/>
# <policy domain="resource" name="map" value="512MiB"/>
# <policy domain="resource" name="disk" value="1GiB"/>
# <policy domain="resource" name="thread" value="4"/>