CVE-2026-30936: ImageMagick Buffer Overflow Vulnerability

CVE-2026-30936 Overview

ImageMagick, a widely-used open-source software suite for editing and manipulating digital images, contains a heap-based buffer overflow vulnerability in the WaveletDenoiseImage method. Prior to versions 7.1.2-16 and 6.9.13-41, a specially crafted image could trigger an out-of-bounds heap write when processed with the -wavelet-denoise operation. This vulnerability could allow an attacker to corrupt heap memory, potentially leading to denial of service conditions.

Critical Impact
A crafted malicious image can cause heap memory corruption when processed with ImageMagick's wavelet denoise functionality, potentially crashing applications or services that process untrusted images.

Affected Products

ImageMagick versions prior to 7.1.2-16
ImageMagick versions prior to 6.9.13-41
Any application or service using vulnerable ImageMagick libraries for image processing

Discovery Timeline

2026-03-10 - CVE-2026-30936 published to NVD
2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-30936

Vulnerability Analysis

This vulnerability is classified as CWE-122 (Heap-based Buffer Overflow). The flaw exists within the WaveletDenoiseImage method, which is invoked when users apply the -wavelet-denoise operation to images. When processing a maliciously crafted image, the function fails to properly validate buffer boundaries, resulting in an out-of-bounds write to heap memory.

The vulnerability requires local access and user interaction—an attacker must convince a user to process a malicious image file, or target automated image processing pipelines that handle untrusted content. While the attack complexity is low and no privileges are required, the impact is primarily limited to availability, potentially causing application crashes or service disruption.

Root Cause

The root cause lies in insufficient boundary checking within the WaveletDenoiseImage function. When processing certain crafted image dimensions or pixel data, the function calculates buffer sizes incorrectly, allowing write operations to exceed allocated heap memory boundaries. This heap-based buffer overflow (CWE-122) occurs because the code does not adequately validate that write operations remain within the bounds of allocated memory regions.

Attack Vector

The attack vector is local, requiring an attacker to deliver a malicious image file to the target system. Exploitation scenarios include:

Direct Processing: A user manually processing a malicious image using ImageMagick's command-line tools with the -wavelet-denoise option
Automated Pipelines: Web applications or services that use ImageMagick to process user-uploaded images with wavelet denoise filtering
Document Processing: Applications that extract and process embedded images from documents

The vulnerability is triggered specifically when the -wavelet-denoise operation is applied to the crafted image, causing the out-of-bounds heap write during the denoising computation.

Detection Methods for CVE-2026-30936

Indicators of Compromise

Unexpected crashes or segmentation faults in ImageMagick processes during image processing operations
Application logs showing errors related to memory corruption or heap violations in WaveletDenoiseImage
Unusual image files with malformed headers or dimensions targeting wavelet denoise processing
Core dumps indicating heap corruption in ImageMagick-related processes

Detection Strategies

Monitor for crashes in ImageMagick processes, particularly those involving the -wavelet-denoise operation
Implement file integrity monitoring to detect suspicious image uploads in web applications
Deploy application-level logging to track ImageMagick command invocations and their parameters
Use memory debugging tools (AddressSanitizer, Valgrind) in development environments to detect heap violations

Monitoring Recommendations

Enable verbose logging for image processing services to capture processing failures and anomalies
Set up automated alerts for repeated ImageMagick process crashes or unexpected terminations
Monitor system resources for signs of exploitation attempts, such as unusual memory consumption patterns
Review uploaded image files for suspicious characteristics before processing with vulnerable operations

How to Mitigate CVE-2026-30936

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-16 or later for the 7.x branch
Upgrade ImageMagick to version 6.9.13-41 or later for the 6.x branch
Review and update all applications and services that depend on ImageMagick libraries
Temporarily disable the -wavelet-denoise operation if patching is not immediately possible

Patch Information

ImageMagick has released security patches addressing this vulnerability. The fix is included in versions 7.1.2-16 and 6.9.13-41. Organizations should update to these versions or later to remediate the vulnerability. For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

Disable or restrict access to the -wavelet-denoise operation in ImageMagick policy files until patching is complete
Implement input validation to reject potentially malicious image files before processing
Run ImageMagick processes in sandboxed environments with limited system access
Use ImageMagick's security policy (policy.xml) to restrict resource limits and disable risky operations

bash

# Example ImageMagick policy.xml configuration to restrict operations
# Add to /etc/ImageMagick-7/policy.xml or equivalent

# Disable potentially dangerous coders
# <policy domain="coder" rights="none" pattern="*" />
# <policy domain="coder" rights="read|write" pattern="{PNG,JPEG,GIF,WEBP}" />

# Set resource limits to mitigate impact
# <policy domain="resource" name="memory" value="256MiB"/>
# <policy domain="resource" name="map" value="512MiB"/>
# <policy domain="resource" name="disk" value="1GiB"/>