CVE-2026-30936
Out-of-Bounds Heap Write in ImageMagick WaveletDenoise
Publication date: 2026-03-10
Last updated on: 2026-03-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| imagemagick | imagemagick | to 6.9.13-41 (exc) |
| imagemagick | imagemagick | From 7.0.0-0 (inc) to 7.1.2-16 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-30936 is a moderate severity heap buffer overflow vulnerability in the ImageMagick software, specifically within the WaveletDenoiseImage function.
This vulnerability occurs when processing a crafted image using the -wavelet-denoise operation, which can trigger an out-of-bounds heap write leading to memory corruption.
The issue affects ImageMagick versions prior to 7.1.2-16 and 6.9.13-41 and has been fixed in these versions.
Technically, it is a heap-based buffer overflow (CWE-122) where a write operation of 4 bytes occurs outside the allocated heap buffer.
How can this vulnerability impact me? :
Exploitation of this vulnerability requires local access and user interaction but no special privileges.
The primary impact is a loss of availability, meaning it can cause a denial of service by crashing or destabilizing the ImageMagick process.
There is no impact on confidentiality or integrity according to the CVSS metrics.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability occurs when processing a crafted image using the -wavelet-denoise operation in vulnerable versions of ImageMagick. Detection involves identifying if your system is running a vulnerable version of ImageMagick prior to 7.1.2-16 or 6.9.13-41.
You can check the installed ImageMagick version with the following command:
- magick -version
To detect attempts to exploit this vulnerability, monitor for crashes or AddressSanitizer errors related to heap-buffer-overflow during image processing, especially when the -wavelet-denoise operation is used.
There are no specific network detection commands provided, as the attack vector is local and requires user interaction.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade ImageMagick to a fixed version, specifically version 7.1.2-16 or later, or 6.9.13-41 or later.
Until the upgrade can be applied, avoid processing untrusted images with the -wavelet-denoise operation to prevent triggering the vulnerability.
Additionally, monitor your systems for crashes or abnormal behavior during image processing to detect potential exploitation attempts.