CVE-2026-22770
MEDIUM
ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails
Published January 20, 2026Updated February 5, 2026Source: osv
Summary
The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.
Remediation
Upgrade to the fixed version using your package manager.
NuGet
Update Magick.NET-Q8-x64 to 14.10.2 or laterdotnet add package Magick.NET-Q8-x64 --version 14.10.2
NuGet
Update Magick.NET-Q16-HDRI-OpenMP-x64 to 14.10.2 or laterdotnet add package Magick.NET-Q16-HDRI-OpenMP-x64 --version 14.10.2
NuGet
Update Magick.NET-Q8-AnyCPU to 14.10.2 or laterdotnet add package Magick.NET-Q8-AnyCPU --version 14.10.2
NuGet
Update Magick.NET-Q16-HDRI-OpenMP-arm64 to 14.10.2 or laterdotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.10.2
NuGet
Update Magick.NET-Q16-OpenMP-arm64 to 14.10.2 or laterdotnet add package Magick.NET-Q16-OpenMP-arm64 --version 14.10.2
NuGet
Update Magick.NET-Q16-HDRI-arm64 to 14.10.2 or laterdotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.10.2
NuGet
Update Magick.NET-Q8-x86 to 14.10.2 or laterdotnet add package Magick.NET-Q8-x86 --version 14.10.2
NuGet
Update Magick.NET-Q16-x86 to 14.10.2 or laterdotnet add package Magick.NET-Q16-x86 --version 14.10.2
NuGet
Update Magick.NET-Q16-OpenMP-x86 to 14.10.2 or laterdotnet add package Magick.NET-Q16-OpenMP-x86 --version 14.10.2
NuGet
Update Magick.NET-Q16-arm64 to 14.10.2 or laterdotnet add package Magick.NET-Q16-arm64 --version 14.10.2
NuGet
Update Magick.NET-Q8-OpenMP-x64 to 14.10.2 or laterdotnet add package Magick.NET-Q8-OpenMP-x64 --version 14.10.2
NuGet
Update Magick.NET-Q16-HDRI-x64 to 14.10.2 or laterdotnet add package Magick.NET-Q16-HDRI-x64 --version 14.10.2
NuGet
Update Magick.NET-Q8-arm64 to 14.10.2 or laterdotnet add package Magick.NET-Q8-arm64 --version 14.10.2
NuGet
Update Magick.NET-Q16-HDRI-x86 to 14.10.2 or laterdotnet add package Magick.NET-Q16-HDRI-x86 --version 14.10.2
NuGet
Update Magick.NET-Q8-OpenMP-arm64 to 14.10.2 or laterdotnet add package Magick.NET-Q8-OpenMP-arm64 --version 14.10.2
NuGet
Update Magick.NET-Q16-AnyCPU to 14.10.2 or laterdotnet add package Magick.NET-Q16-AnyCPU --version 14.10.2
NuGet
Update Magick.NET-Q16-OpenMP-x64 to 14.10.2 or laterdotnet add package Magick.NET-Q16-OpenMP-x64 --version 14.10.2
NuGet
Update Magick.NET-Q16-x64 to 14.10.2 or laterdotnet add package Magick.NET-Q16-x64 --version 14.10.2
NuGet
Update Magick.NET-Q16-HDRI-AnyCPU to 14.10.2 or laterdotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.10.2
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (19)
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| Magick.NET-Q8-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+220 more) | 14.10.2 |
| Magick.NET-Q16-HDRI-OpenMP-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+101 more) | 14.10.2 |
| Magick.NET-Q8-AnyCPU | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+204 more) | 14.10.2 |
| Magick.NET-Q16-HDRI-OpenMP-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+49 more) | 14.10.2 |
| Magick.NET-Q16-OpenMP-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+49 more) | 14.10.2 |
| Magick.NET-Q16-HDRI-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+49 more) | 14.10.2 |
| Magick.NET-Q8-x86 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+220 more) | 14.10.2 |
| Magick.NET-Q16-x86 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+220 more) | 14.10.2 |
| Magick.NET-Q16-OpenMP-x86 | nuget | All versions | 14.10.2 |
| Magick.NET-Q16-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+49 more) | 14.10.2 |
| Magick.NET-Q8-OpenMP-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+101 more) | 14.10.2 |
| Magick.NET-Q16-HDRI-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+201 more) | 14.10.2 |
| Magick.NET-Q8-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+49 more) | 14.10.2 |
| Magick.NET-Q16-HDRI-x86 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+201 more) | 14.10.2 |
| Magick.NET-Q8-OpenMP-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+49 more) | 14.10.2 |
| Magick.NET-Q16-AnyCPU | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+204 more) | 14.10.2 |
| Magick.NET-Q16-OpenMP-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+101 more) | 14.10.2 |
| Magick.NET-Q16-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+220 more) | 14.10.2 |
| Magick.NET-Q16-HDRI-AnyCPU | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+201 more) | 14.10.2 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-763
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 6.5 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
References
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-39h3-g67r-7g3cWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-22770ADVISORY
- https://github.com/ImageMagick/ImageMagick/commit/3e0330721020e0c5bb52e4b77c347527dd71658eWEB
- https://github.com/ImageMagick/ImageMagickPACKAGE
- https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2WEB
Frequently Asked Questions
- What is CVE-2026-22770?
- ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 6.5/10).
- How do I check if my project is affected by CVE-2026-22770?
- CVE-2026-22770 affects Magick.NET-Q8-x64, Magick.NET-Q16-HDRI-OpenMP-x64 and Magick.NET-Q8-AnyCPU (and 16 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-22770 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
6.5
Exploitation requires specific conditions or has limited impact. Remediate within weeks.
Also Known As
GHSA-39h3-g67r-7g3c
Related CVEs
- CVE-2026-25989HIGH
ImageMagick: Integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder
- CVE-2026-28687MEDIUM
ImageMagick has Heap Use-After-Free in ImageMagick MSL decoder
- CVE-2026-28692MEDIUM
ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder
- CVE-2026-27799MEDIUM
ImageMagick has a heap Buffer Over-read in its DJVU image format handler
- CVE-2026-46557MEDIUM
ImageMagick: Stack overflow in fx operation
- CVE-2026-25984LOW
ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds
- CVE-2026-56376LOW
ImageMagick has a possible heap Use After Free vulnerability in its meta coder
- CVE-2025-55212LOW
ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crash
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies