CVE-2026-48724: ImageMagick Heap Buffer Over-Write in Floyd-Steinberg Dithering

Technical summary

CVE-2026-48724 is a negative heap buffer over-write vulnerability in ImageMagick's dithering implementation. When the Floyd-Steinberg dithering method processes an image with a mask layer, a boundary condition fails to prevent writing beyond allocated heap boundaries in the negative direction. This is classified as an out-of-bounds write (CWE-787). The vulnerability requires local file access and user interaction to trigger, as it manifests only during image processing operations initiated by the end user.

Business impact

The primary business risk is denial of service—legitimate image processing workflows will crash when encountering malicious files. This could disrupt automated batch processing pipelines, web services that resize or convert user-uploaded images, and desktop applications relying on ImageMagick. Secondary risk includes potential data corruption if the heap over-write corrupts adjacent memory structures before the crash occurs. Organizations running ImageMagick in user-facing or batch contexts should treat this as a stability and availability issue.

Affected systems

ImageMagick prior to version 7.1.2-24 is affected. This includes all 7.1.2 releases up to and including 7.1.2-23, as well as all earlier major and minor versions (7.1.1, 7.1.0, 7.0.x, 6.x, etc.). Any system or service using an unpatched ImageMagick installation that processes untrusted images—such as web servers handling user uploads, batch image conversion services, or content management systems—is in scope.

Exploitability

The vulnerability has a low exploitability barrier in terms of technical complexity. An attacker needs only to craft a PNG, GIF, or other image format that combines a mask with dithering parameters and distribute it to target users. However, actual exploitation requires user interaction: the victim must open or process the image file within an application that uses the vulnerable ImageMagick library. There is no unauthenticated network vector; this is strictly a local file processing issue. The defect does not appear on the public KEV catalog, indicating no evidence of active in-the-wild exploitation at the time of publication.

Remediation

Update ImageMagick to version 7.1.2-24 or later. This patch addresses the boundary condition in the Floyd-Steinberg dithering routine. Organizations should test the patched version in a staging environment first, particularly if they run complex image processing pipelines, to ensure compatibility with existing workflows. For systems where immediate patching is not feasible, input validation (rejecting images with mask+dithering combinations) or sandboxing ImageMagick processes can reduce risk.

Patch guidance

Apply the official ImageMagick 7.1.2-24 update from the project repository or your distribution's package manager. Verify the patch was successfully applied by confirming the installed version via 'convert -version'. If you maintain a custom ImageMagick build, rebuild from the patched source code. No workarounds exist; patching is the definitive remediation. Coordinate patching across all systems where ImageMagick is installed, including development machines, CI/CD infrastructure, and production servers.

Detection guidance

Monitor for ImageMagick process crashes or segmentation faults when processing images with dithering operations. Application logs may show memory access violations. Network-based detection is limited since this is a local file issue; instead, focus on endpoint monitoring. Check running process versions with 'convert -version' to identify unpatched installations. For enterprise deployments, software asset management tools can scan for ImageMagick versions and flag those below 7.1.2-24. No specific intrusion detection signatures are needed, as the vulnerability does not enable network compromise.

Why prioritize this

This vulnerability merits prompt but not emergency prioritization. The CVSS score of 5.5 reflects medium severity: it impacts availability (denial of service) via a local attack requiring user interaction. Organizations with high-volume image processing workflows, user-uploaded content handling, or batch automation should patch within 2–3 weeks. Those with limited ImageMagick exposure can extend the timeline to 4–6 weeks. The absence from the KEV catalog and lack of public exploit code reduce the urgency relative to critical network-exploitable flaws, but the simplicity of triggering a crash on unprotected systems justifies timely remediation.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects: Attack Vector (Local), Attack Complexity (Low), Privileges Required (None), User Interaction (Required), Scope (Unchanged), and no impact on Confidentiality or Integrity, but high impact on Availability. The score appropriately captures that an attacker cannot silently corrupt data or extract secrets, but can reliably cause application crashes. The lack of privilege escalation or scope expansion keeps the score in the medium band despite the reliable denial-of-service mechanism.

Frequently asked questions