CVE-2026-27798: ImageMagick: Heap Buffer Over-read in WaveletDenoise when processing small images
(updated )
A heap buffer over-read vulnerability occurs when processing an image with small dimension using the -wavelet-denoise operator.
==3693336==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x511000001280 at pc 0x5602c8b0cc75 bp 0x7ffcb105d510 sp 0x7ffcb105d500
READ of size 4 at 0x511000001280 thread T0
References
- github.com/ImageMagick/ImageMagick
- github.com/ImageMagick/ImageMagick/commit/0377e60b3c0d766bd7271221c95d9ee54f6a3738
- github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qpgx-jfcq-r59f
- github.com/advisories/GHSA-qpgx-jfcq-r59f
- github.com/dlemstra/Magick.NET/releases/tag/14.10.3
- nvd.nist.gov/vuln/detail/CVE-2026-27798
Code Behaviors & Features
Detect and mitigate CVE-2026-27798 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →