CVE-2026-30935
Received Received - Intake
Heap Buffer Over-Read in ImageMagick BilateralBlurImage Component

Publication date: 2026-03-10

Last updated on: 2026-03-11

Assigner: GitHub, Inc.

Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, BilateralBlurImage contains a heap buffer over-read caused by an incorrect conversion. When processing a crafted image with the -bilateral-blur operation an out of bounds read can occur. This vulnerability is fixed in 7.1.2-16.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-10
Last Modified
2026-03-11
Generated
2026-06-16
AI Q&A
2026-03-10
EPSS Evaluated
2026-06-15
NVD
CVE-2026-30935
EUVD
EUVD-2026-10399
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
imagemagick imagemagick to 7.1.2-16 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-30935 is a moderate severity vulnerability in ImageMagick versions prior to 7.1.2-16, specifically in the BilateralBlurImage function.

The issue is a heap buffer over-read caused by an incorrect conversion during the processing of crafted images using the -bilateral-blur operation, leading to an out-of-bounds read.

This means that when a specially crafted image is processed, the software reads memory beyond the allocated buffer, which can cause unexpected behavior or crashes.

The vulnerability is related to weaknesses CWE-125 (Out-of-bounds Read) and CWE-190 (Integer Overflow or Wraparound), where improper calculations cause the buffer over-read.

Impact Analysis

This vulnerability can lead to a low impact on confidentiality and availability, with no impact on integrity.

An attacker with local access and requiring user interaction could exploit this vulnerability to cause the application to read memory out of bounds, potentially leading to crashes or denial of service.

Since the attack vector is local and user interaction is required, remote exploitation is unlikely.

Compliance Impact

I don't know

Detection Guidance

This vulnerability occurs when processing crafted images using the -bilateral-blur operation in vulnerable versions of ImageMagick prior to 7.1.2-16.

To detect if your system is vulnerable, you can check the installed ImageMagick version by running the command:

  • magick -version

If the version is earlier than 7.1.2-16, your system is potentially vulnerable.

Additionally, you can attempt to process images with the -bilateral-blur operation and monitor for crashes or abnormal behavior, but this requires crafted test images and may not be safe in production.

Mitigation Strategies

The primary mitigation step is to upgrade ImageMagick to version 7.1.2-16 or later, where this vulnerability has been fixed.

Until the upgrade can be applied, avoid processing untrusted or crafted images using the -bilateral-blur operation to prevent triggering the heap buffer over-read.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-30935. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart