CVE-2026-22770: ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails
The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.
References
- github.com/ImageMagick/ImageMagick
- github.com/ImageMagick/ImageMagick/commit/3e0330721020e0c5bb52e4b77c347527dd71658e
- github.com/ImageMagick/ImageMagick/security/advisories/GHSA-39h3-g67r-7g3c
- github.com/advisories/GHSA-39h3-g67r-7g3c
- github.com/dlemstra/Magick.NET/releases/tag/14.10.2
- nvd.nist.gov/vuln/detail/CVE-2026-22770
Code Behaviors & Features
Detect and mitigate CVE-2026-22770 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →