Junglewise Threat Intelligence

CVE-2026-48724: ImageMagick heap buffer underwrite in Floyd-Steinberg dithering

CVE-2026-48724 · Severity: medium · CVSS 5.5 · Published 2026-06-10

Technologies: Magick.NET-Q16-OpenMP-arm64 (NuGet), Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet), Magick.NET-Q8-x86 (NuGet), Magick.NET-Q8-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet), Magick.NET-Q16-OpenMP-x64 (NuGet), Magick.NET-Q16-HDRI-arm64 (NuGet), Magick.NET-Q16-HDRI-x86 (NuGet), Magick.NET-Q16-HDRI-x64 (NuGet), Magick.NET-Q8-OpenMP-arm64 (NuGet), Magick.NET-Q8-OpenMP-x64 (NuGet), Magick.NET-Q16-x64 (NuGet), Magick.NET-Q8-arm64 (NuGet), Magick.NET-Q8-x64 (NuGet), Magick.NET-Q16-x86 (NuGet), Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet). Vendors: NuGet, ImageMagick.

Executive brief

ImageMagick, a widely used suite for displaying and converting images, is vulnerable to a memory corruption issue when processing certain image files. An attacker could provide a specially crafted image with a mask that, when processed using specific dithering settings, causes the application to crash. This could lead to a denial-of-service, impacting the availability of services that rely on this library for image processing.

Technical details

A heap buffer underwrite (CWE-787) exists in ImageMagick's Floyd-Steinberg depth dithering implementation. The vulnerability is triggered when processing an image that contains a mask, leading to a negative heap buffer overwrite. An attacker can exploit this by providing a malicious image file to be processed by a vulnerable version of the library. Successful exploitation results in a crash (denial of service), though the CVSS score indicates no immediate impact on confidentiality or integrity. The issue is addressed in Magick.NET version 14.14.0.

Affected products

  • ImageMagick Magick.NET < 14.14.0

Timeline

  • 2026-05-30: disclosed: Initial disclosure to ImageMagick repository
  • 2026-06-10: advisory: NVD publication date
  • 2026-06-25: patched: GitHub Advisory reviewed and updated with patch information

References

Related threats