ImageMagick up to 7.1.2-12 BilateralBlurImage release of reference

Summaryinfo

A vulnerability was found in ImageMagick up to 7.1.2-12. It has been classified as problematic. Affected by this vulnerability is the function BilateralBlurImage. Performing a manipulation results in release of reference. This vulnerability was named CVE-2026-22770. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, was found in ImageMagick up to 7.1.2-12. This affects the function BilateralBlurImage. The manipulation with an unknown input leads to a release of reference vulnerability. CWE is classifying the issue as CWE-763. The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

ImageMagick is free and open-source software used for editing and manipulating digital images. The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But, in versions prior to 7.1.2-13, the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails. Version 7.1.2-13 contains a patch for the issue.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-22770 since 01/09/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 296648 (Debian dsa-6111 : imagemagick - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 7.1.2-13 eliminates this vulnerability. Applying the patch 3e0330721020e0c5bb52e4b77c347527dd71658e is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at CNNVD (CNNVD-202601-3319), Tenable (296648) and CERT Bund (WID-SEC-2026-0148). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Open Source ImageMagick

Productinfo

Type

• Image Processing Software

Name

• ImageMagick

Version

• 7.1.2-12

License

• open-source

Website

• Product: https://www.imagemagick.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion