CVE-2026-30935
Heap Buffer Over-Read in ImageMagick BilateralBlurImage Component
Publication date: 2026-03-10
Last updated on: 2026-03-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| imagemagick | imagemagick | to 7.1.2-16 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
| CWE-190 | The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-30935 is a moderate severity vulnerability in ImageMagick versions prior to 7.1.2-16, specifically in the BilateralBlurImage function.
The issue is a heap buffer over-read caused by an incorrect conversion during the processing of crafted images using the -bilateral-blur operation, leading to an out-of-bounds read.
This means that when a specially crafted image is processed, the software reads memory beyond the allocated buffer, which can cause unexpected behavior or crashes.
The vulnerability is related to weaknesses CWE-125 (Out-of-bounds Read) and CWE-190 (Integer Overflow or Wraparound), where improper calculations cause the buffer over-read.
How can this vulnerability impact me? :
This vulnerability can lead to a low impact on confidentiality and availability, with no impact on integrity.
An attacker with local access and requiring user interaction could exploit this vulnerability to cause the application to read memory out of bounds, potentially leading to crashes or denial of service.
Since the attack vector is local and user interaction is required, remote exploitation is unlikely.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability occurs when processing crafted images using the -bilateral-blur operation in vulnerable versions of ImageMagick prior to 7.1.2-16.
To detect if your system is vulnerable, you can check the installed ImageMagick version by running the command:
- magick -version
If the version is earlier than 7.1.2-16, your system is potentially vulnerable.
Additionally, you can attempt to process images with the -bilateral-blur operation and monitor for crashes or abnormal behavior, but this requires crafted test images and may not be safe in production.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade ImageMagick to version 7.1.2-16 or later, where this vulnerability has been fixed.
Until the upgrade can be applied, avoid processing untrusted or crafted images using the -bilateral-blur operation to prevent triggering the heap buffer over-read.