5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48724

CVE-2026-48724: ImageMagick: Heap Buffer Underwrite in Floyd-Steinberg depth dithering

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-24, when using an image with mask the Floyd-Steinberg dithering method it will cause a negative heap buffer over-write. This issue has been patched in version 7.1.2-24.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48724

CVE-2026-48724:

5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-x86	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-OpenMP-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-x86	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-AnyCPU	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-OpenMP-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-x86	nuget	< 14.14.0	14.14.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a heap buffer underwrite within the Floyd-Steinberg dithering implementation in ImageMagick. The root cause was identified by analyzing the commit 017c7efe4d63b953b35ab96fc0939ba3620e4739, which is explicitly linked to the security advisory GHSA-2hhq-c99x-492r. The patch modifies the FloydSteinbergImageDepth function in MagickCore/attribute.c. The change involves adding index increments (u++ and v++) before a continue statement. This is necessary when skipping pixels that are masked out. In the vulnerable version, failing to increment these indices meant that on a subsequent iteration, the program would write to a stale, out-of-bounds location in the distortion heap buffer, causing memory corruption. The identified vulnerable function, FloydSteinbergImageDepth, is the exact location of the flawed logic and would be present in any runtime profile when triggering this vulnerability.

Vulnerable functions

FloydSteinbergImageDepth

MagickCore/attribute.c

The vulnerability exists in the `FloydSteinbergImageDepth` function. When processing an image with a mask, certain pixels are skipped. The original code would `continue` the loop for these pixels without incrementing the `u` and `v` indices for the `distortion` buffer. This caused the next pixel's error value to be written to an incorrect, earlier position in the buffer, leading to a heap buffer underwrite. The patch fixes this by adding `u++` and `v++` before the `continue` statement, ensuring the buffer indices are correctly advanced even for skipped pixels.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

5.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-48724: ImageMagick: Heap Buffer Underwrite in Floyd-Steinberg depth dithering

CVE-2026-48724:

5.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Detect and Respond To Threats Faster.

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

CVE-2026-48724: ImageMagick: Heap Buffer Underwrite in Floyd-Steinberg depth dithering

5.5

5.5

Technical Details

5.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-48724: ImageMagick: Heap Buffer Underwrite in Floyd-Steinberg depth dithering

CVE-2026-48724:

5.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2026-48724: ImageMagick: Heap Buffer Underwrite in Floyd-Steinberg depth dithering

5.5

5.5

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI