CVE Intelligence
Analysis AI-assisted

CVE-2026-22770: ImageMagick BilateralBlur invalid pointer release on allocation failure

CVE-2026-22770 affects ImageMagick versions before 7.1.2-13. When memory allocation fails in the BilateralBlurImage path, the last element of a buffer set is not properly initialized, which can lead to release of an invalid pointer. The record states that version 7.1.2-13 contains a patch.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-22770 is a memory-handling defect in the BilateralBlurImage code path of ImageMagick. According to the record, a set of double buffers allocated in AcquireBilateralTLS has an improperly initialized last element, and DestroyBilateralTLS may release an invalid pointer when allocation fails. The CNA is GitHub (GitHub_M) and the record was published on 2026-01-20.

Impact

  • The NVD CVSS base score in the record is 9.8, with severity marked critical.
  • The GitHub score in the record is 6.5.
  • The record lists CWE-763 with no name, SSVC technical impact as partial, and SSVC automatable as no.
  • The record describes a release of an invalid pointer. It does not describe a demonstrated impact on confidentiality, integrity or availability beyond that.

Affected products and versions

  • Product: ImageMagick (Imagemagick Imagemagick).
  • Affected: versions before 7.1.2-13.
  • Corrected: version 7.1.2-13, as stated in the record and the linked patch commit.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00391 with percentile 0.32044, and the SSVC exploitation field is none.

Remediation and mitigation

  • Upgrade ImageMagick to 7.1.2-13 or a later release that includes the upstream fix.
  • If an immediate upgrade is not possible, reduce exposure by limiting which users and services can submit images to ImageMagick, and isolate processing hosts (inference, not a vendor-stated workaround).
  • Review the linked GitHub advisory and patch commit to confirm the fix is present in deployed builds.

Detection guidance

  • Inventory every ImageMagick installation, including packaged libraries and container images, and record their exact versions.
  • Monitor for abnormal terminations or crashes of ImageMagick processes, especially under memory pressure, as these may indicate faults in this code path.
  • Track memory allocation failures reported by hosts running image-processing workloads.

Limitations of the available information

The record does not describe a detailed trigger condition, an observed incident, or a timeline of exploitation. The CWE name is null in the record. NVD and GitHub assign different CVSS base scores, and the record does not explain the difference. The EPSS date in the record is 2026-10-23, which should be verified against the current feed.

Frequently asked questions

Which ImageMagick versions are affected by CVE-2026-22770?

According to the record, versions before 7.1.2-13 are affected.

Is this vulnerability known to be exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do first?

Upgrade ImageMagick to 7.1.2-13 or a later release that includes the fix, then verify the deployed version across all hosts and containers.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.