6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22770

CVE-2026-22770: ImageMagick vulnerable to Release of Invalid Pointer in BilateralBlur when memory allocation fails

ImageMagick is free and open-source software used for editing and manipulating digital images. The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But, in versions prior to 7.1.2-13, the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails. Version 7.1.2-13 contains a patch for the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22770

CVE-2026-22770:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q8-x64	nuget	< 14.10.2	14.10.2
Magick.NET-Q8-arm64	nuget	< 14.10.2	14.10.2
Magick.NET-Q8-x86	nuget	< 14.10.2	14.10.2
Magick.NET-Q8-OpenMP-x64	nuget	< 14.10.2	14.10.2
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-x64	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-arm64	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-x86	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-OpenMP-x64	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-OpenMP-x86	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-HDRI-x64	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-HDRI-arm64	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-HDRI-x86	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-HDRI-OpenMP-x64	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.10.2	14.10.2
Magick.NET-Q8-AnyCPU	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-AnyCPU	nuget	< 14.10.2	14.10.2
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.10.2	14.10.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the memory management within the bilateral blur functionality of ImageMagick. The analysis of the patch in MagickCore/effect.c reveals that the function AcquireBilateralTLS allocates an array of pointers (weights) of size number_threads + 1, but the original code only initialized number_threads elements using memset. This left the last pointer in the array uninitialized.

If a subsequent memory allocation within the loop of AcquireBilateralTLS fails, the cleanup function DestroyBilateralTLS is called. DestroyBilateralTLS iterates through the weights array to free the allocated memory. Since the last element was never initialized, this results in an attempt to free an invalid pointer, leading to a crash and a denial-of-service vulnerability.

The BilateralBlurImage function is the entry point that utilizes this faulty allocation logic, making it a key part of the exploitation path. The patch corrects the memset size to (number_threads + 1) * sizeof(*weights), ensuring all allocated pointers are properly null-initialized before use, thus mitigating the vulnerability.

Vulnerable functions

AcquireBilateralTLS

MagickCore/effect.c

The function allocates `number_threads + 1` elements for the `weights` array but only initializes `number_threads` of them, leaving the last element uninitialized. If a subsequent memory allocation fails, `DestroyBilateralTLS` is called, which attempts to free this uninitialized pointer.

DestroyBilateralTLS

MagickCore/effect.c

This function is responsible for deallocating the memory allocated by `AcquireBilateralTLS`. When `AcquireBilateralTLS` fails, it calls `DestroyBilateralTLS` with a list of pointers that contains an uninitialized member, leading to an attempt to free an invalid pointer.

BilateralBlurImage

MagickCore/effect.c

This is the main function that initiates the bilateral blur effect. It calls `AcquireBilateralTLS` to set up necessary data structures. A memory allocation failure within `AcquireBilateralTLS` triggers the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.