CVE-2026-48724: ImageMagick Buffer Overflow Vulnerability

CVE-2026-48724 Overview

CVE-2026-48724 is a heap buffer over-write vulnerability in ImageMagick, the open-source image editing and manipulation library. The flaw exists in the Floyd-Steinberg dithering implementation when processing an image combined with a mask. Under these conditions, the code performs a negative heap buffer over-write, classified as [CWE-787] Out-of-Bounds Write. All versions prior to 7.1.2-24 are affected. The issue requires local access and user interaction to trigger, and successful exploitation primarily impacts availability by crashing the host process.

Critical Impact

A maliciously crafted image processed with mask-based Floyd-Steinberg dithering triggers an out-of-bounds heap write, leading to process corruption or denial of service.

Affected Products

• ImageMagick versions prior to 7.1.2-24
• Applications and services embedding vulnerable ImageMagick builds
• Image processing pipelines invoking masked dithering operations

Discovery Timeline

• 2026-06-10 - CVE-2026-48724 published to NVD
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-48724

Vulnerability Analysis

The vulnerability resides in the Floyd-Steinberg error-diffusion dithering routine inside ImageMagick. Floyd-Steinberg dithering distributes quantization error from each processed pixel to neighboring pixels. When a mask is applied to the source image, the code path responsible for indexing pixel offsets miscalculates a buffer position. The resulting index becomes negative, and the routine writes pixel or error data outside the allocated heap region. This corrupts adjacent heap metadata or object state. The advisory confirms the patch landed in version 7.1.2-24.

Root Cause

The root cause is improper bounds enforcement when computing pixel offsets in the masked dithering loop. The code does not validate that the computed index remains within the allocated buffer before performing the write. Combined with mask-driven control flow, the index can resolve to a negative value, producing a write before the buffer base address [CWE-787].

Attack Vector

Exploitation requires local access and user interaction. An attacker delivers a crafted image that an authorized user opens or processes with ImageMagick using mask-based Floyd-Steinberg dithering. The attack does not require elevated privileges. Network-based remote exploitation is not described in the advisory. The primary outcome is process crash and denial of service, with no confidentiality or integrity impact reported.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory for technical details on the affected code path.

Detection Methods for CVE-2026-48724

Indicators of Compromise

• Unexpected crashes or abort signals from ImageMagick utilities (convert, magick, mogrify) during image processing jobs
• Heap corruption traces, glibc malloc assertions, or AddressSanitizer reports referencing the dithering code path
• Processing of untrusted images that invoke mask operations together with Floyd-Steinberg dithering

Detection Strategies

• Inventory ImageMagick installations and flag any binary or library reporting a version older than 7.1.2-24
• Inspect application logs and image processing queues for repeated failures correlated with specific input files
• Enable core dump collection on hosts running image conversion services to capture evidence of heap corruption

Monitoring Recommendations

• Alert on abnormal termination of image processing worker processes and child workers spawned by web services
• Track upload patterns that submit images requesting dithering or palette reduction with masks
• Correlate process crashes with file hashes of recently submitted images to identify malicious samples

How to Mitigate CVE-2026-48724

Immediate Actions Required

• Upgrade ImageMagick to version 7.1.2-24 or later across all systems and container images
• Audit downstream applications, language bindings, and Linux distribution packages that ship bundled ImageMagick binaries
• Restrict image processing services to validated input sources until patching is complete

Patch Information

The maintainers fixed the issue in ImageMagick 7.1.2-24. The patch corrects offset calculations in the Floyd-Steinberg dithering path when a mask is present, preventing the negative heap buffer over-write. See the GitHub Security Advisory GHSA-2hhq-c99x-492r for the patch reference.

Workarounds

• Disable or block code paths that combine image masks with Floyd-Steinberg dithering until the upgrade is deployed
• Apply an ImageMagick policy.xml configuration to restrict untrusted coders and limit resource usage during processing
• Sandbox ImageMagick execution using containers, seccomp, or AppArmor profiles to contain crashes and limit blast radius

# Example policy.xml hardening snippet placed in /etc/ImageMagick-7/policy.xml
<policymap>
  <policy domain="resource" name="memory" value="256MiB"/>
  <policy domain="resource" name="map" value="512MiB"/>
  <policy domain="resource" name="disk" value="1GiB"/>
  <policy domain="coder" rights="none" pattern="EPHEMERAL"/>
  <policy domain="coder" rights="none" pattern="URL"/>
  <policy domain="coder" rights="none" pattern="MSL"/>
  <policy domain="filter" rights="none" pattern="*"/>
</policymap>