CVE-2026-27798: ImageMagick Buffer Overflow Vulnerability

CVE-2026-27798 Overview

A heap buffer over-read vulnerability has been identified in ImageMagick, the widely-used open-source software for editing and manipulating digital images. This vulnerability occurs when processing images with small dimensions using the -wavelet-denoise operator. The flaw exists in versions prior to 7.1.2-15 and 6.9.13-40, where insufficient memory allocation leads to out-of-bounds memory access during image processing operations.

Critical Impact

Local attackers can exploit this vulnerability to read sensitive memory contents when processing specially crafted images with small dimensions through the wavelet denoise functionality.

Affected Products

• ImageMagick versions prior to 7.1.2-15
• ImageMagick versions prior to 6.9.13-40
• Magick.NET versions prior to 14.10.3

Discovery Timeline

• February 26, 2026 - CVE-2026-27798 published to NVD
• February 26, 2026 - Last updated in NVD database

Technical Details for CVE-2026-27798

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-bounds Read), a heap buffer over-read condition that manifests during wavelet denoising operations on images with small dimensions. The flaw originates in the MagickCore/visual-effects.c file where memory allocation calculations were insufficient for the required buffer size.

When the -wavelet-denoise operator processes an image, it allocates virtual memory to store pixel data during the denoising algorithm. The original implementation allocated memory for only 3 columns multiplied by the image rows, which proved inadequate under certain conditions. This undersized allocation created a scenario where subsequent read operations could access memory beyond the allocated buffer boundaries.

The vulnerability requires local access to exploit, as an attacker would need to provide a specially crafted image file to be processed by ImageMagick with the wavelet-denoise operator enabled. While the impact is limited to information disclosure (reading uninitialized or adjacent memory), this could potentially expose sensitive data residing in adjacent memory regions.

Root Cause

The root cause lies in an incorrect memory allocation size calculation in the AcquireVirtualMemory function call within the wavelet denoise processing code. The allocation used 3*image->columns instead of the correct 4*image->columns, resulting in a buffer that was 25% smaller than required for safe operation. This miscalculation meant that when the denoising algorithm attempted to access the fourth column of pixel data, it would read beyond the allocated buffer.

Attack Vector

The attack vector requires local access to the system running ImageMagick. An attacker must craft a malicious image with specific small dimensions and convince the target system to process it using the -wavelet-denoise operator. This could occur in scenarios where ImageMagick is used in automated image processing pipelines, web applications that accept user-uploaded images, or batch processing scripts.

The exploitation does not require any privileges and has low complexity, though user interaction may be required to trigger the vulnerable code path. Successful exploitation results in unauthorized read access to adjacent memory contents, potentially disclosing sensitive information.

// Security patch in MagickCore/visual-effects.c
// Source: https://github.com/ImageMagick/ImageMagick/commit/0377e60b3c0d766bd7271221c95d9ee54f6a3738
     }
   if (AcquireMagickResource(WidthResource,4*image->columns) == MagickFalse)
     ThrowImageException(ResourceLimitError,"MemoryAllocationFailed");
-  pixels_info=AcquireVirtualMemory(3*image->columns,image->rows*
+  pixels_info=AcquireVirtualMemory(4*image->columns,image->rows*
     sizeof(*pixels));
   kernel=(float *) AcquireQuantumMemory(MagickMax(image->rows,image->columns)+1,
     GetOpenMPMaximumThreads()*sizeof(*kernel));

Source: GitHub Commit

Detection Methods for CVE-2026-27798

Indicators of Compromise

• Unexpected memory access errors or segmentation faults when processing small images with wavelet denoise operations
• Abnormal memory consumption patterns during ImageMagick image processing operations
• Application crashes or unexpected behavior when using the -wavelet-denoise operator on images with unusual dimensions

Detection Strategies

• Monitor ImageMagick processes for memory access violations or out-of-bounds read attempts
• Implement version checking to identify installations running vulnerable ImageMagick versions (prior to 7.1.2-15 or 6.9.13-40)
• Deploy runtime application self-protection (RASP) solutions to detect heap buffer over-read attempts

Monitoring Recommendations

• Enable Address Sanitizer (ASan) in development and testing environments to catch heap buffer over-reads
• Configure logging for ImageMagick operations to track usage of the -wavelet-denoise operator
• Implement file integrity monitoring on ImageMagick binaries to detect unauthorized modifications

How to Mitigate CVE-2026-27798

Immediate Actions Required

• Upgrade ImageMagick to version 7.1.2-15 or later for the 7.x branch
• Upgrade ImageMagick to version 6.9.13-40 or later for the 6.x branch
• Update Magick.NET to version 14.10.3 or later if using the .NET wrapper
• Audit systems to identify all ImageMagick installations and their versions

Patch Information

Security patches are available through the official ImageMagick repositories. The fix corrects the memory allocation calculation in MagickCore/visual-effects.c by changing the multiplier from 3 to 4 for column allocation. Detailed patch information is available in the GitHub Security Advisory and the commit changes.

Workarounds

• Disable or restrict access to the -wavelet-denoise operator in ImageMagick policy configuration if not required
• Implement input validation to reject images with extremely small dimensions before processing
• Use sandboxing or containerization to limit the potential impact of memory disclosure

# Configuration example - Restrict wavelet-denoise in policy.xml
# Add to /etc/ImageMagick-7/policy.xml or equivalent location
<policy domain="delegate" rights="none" pattern="wavelet-denoise" />