PT-2026-3526 · Unknown · Imagemagick

Lemstra · Published 2026-01-04 · Updated 2026-03-09 · CVE-2026-22770

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-13

Description ImageMagick is software used for editing and manipulating digital images. A flaw exists in the BilateralBlurImage method where double buffers allocated inside AcquireBilateralTLS are not fully initialized. This can lead to the release of an invalid pointer within the DestroyBilateralTLS function when memory allocation fails.

Recommendations Update ImageMagick to version 7.1.2-13 or later.

Exploit

Fix

Weakness Enumeration

CWE-763

Related Identifiers

BDU:2026-00644

CVE-2026-22770

ECHO-88C3-EBA5-4D7B

GHSA-39H3-G67R-7G3C

OESA-2026-1242

OESA-2026-1243

OESA-2026-1244

OESA-2026-1245

OESA-2026-1246

OPENSUSE-SU-2026:10119-1

OPENSUSE-SU-2026:20337-1

SUSE-SU-2026:0437-1

SUSE-SU-2026:0438-1

Affected Products

Imagemagick

References · 112

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22770.json · Exploit
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-39h3-g67r-7g3c · Vendor Advisory
• https://github.com/ImageMagick/ImageMagick/commit/3e0330721020e0c5bb52e4b77c347527dd71658e · Patch
• https://osv.dev/vulnerability/OESA-2026-1244 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22770 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1243 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1245 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2026-22770 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22770 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23952 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22770 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-22770 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1246 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1242 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23874 · Security Note