CVE-2026-30936
Plain English Summary
AI-powered analysis for quick understanding
An attacker can create a specially crafted image that, when processed by vulnerable versions of ImageMagick using the wavelet denoise feature, can lead to unintended memory changes, potentially allowing them to execute arbitrary code. This issue affects versions prior to 7.1.2-16 and 6.9.13-41, so updating to these versions or later is essential to mitigate the risk.
Technical Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a crafted image could cause an out of bounds heap write inside the WaveletDenoiseImage method. When processing a crafted image with the -wavelet-denoise operation an out of bounds write can occur. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
CVSS Vector Analysis
Vector String
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploit Resources
Search for proof-of-concept code and exploit modules
Official References
Quick Information
Published
Mar 10, 2026
28 days ago
Last Modified
Mar 11, 2026
27 days ago
Vendor
imagemagick
Product
imagemagick
Related Vulnerabilities
This vulnerability allows an attacker to cause an application using ImageMagick to read data from memory that it shouldn't, potentially exposing sensitive information. It occurs when processing specially crafted images with the bilateral blur feature, and it affects versions prior to 7.1.2-16.
This vulnerability allows an attacker to exploit a flaw in ImageMagick's UHDR encoder, potentially leading to unauthorized access or control over the system by writing data outside the intended memory space. It affects versions prior to 7.1.2-16, so users must upgrade to this version or later to protect against this risk.
This vulnerability allows an attacker to crash the ImageMagick software or potentially execute malicious code by sending a specially crafted image that overflows a fixed-size memory area. It affects versions prior to 7.1.2-16 and 6.9.13-41, so users should update to these versions or later to protect against this risk.
This vulnerability allows an attacker to crash the ImageMagick software or potentially execute harmful code by sending a specially crafted PNG image with an excessively large profile. It affects versions prior to 7.1.2-16 and 6.9.13-41, so using an updated version is crucial to avoid exploitation.
This vulnerability allows an attacker to manipulate images in a way that can lead to reading or writing data outside of the intended memory space, potentially causing crashes or executing malicious code. It affects specific older versions of ImageMagick, so users need to upgrade to the latest versions to protect against this risk.