CVE-2026-22770
Published: 20 January 2026
Summary
CVE-2026-22770 is a medium-severity Release of Invalid Pointer or Reference (CWE-763) vulnerability in Imagemagick Imagemagick. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 20.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Memory corruption in image library directly enables remote application exploitation resulting in DoS via crash (high availability impact).
NVD Description
ImageMagick is free and open-source software used for editing and manipulating digital images. The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But, in versions prior to 7.1.2-13, the last element in the set is not properly…
more
initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails. Version 7.1.2-13 contains a patch for the issue.
Deeper analysisAI
CVE-2026-22770 is a memory safety vulnerability in ImageMagick, a free and open-source software suite for editing and manipulating digital images. The issue affects versions prior to 7.1.2-13 and resides in the BilateralBlurImage method, which allocates a set of double buffers via AcquireBilateralTLS. In vulnerable versions, the last element in this set is not properly initialized, leading to the release of an invalid pointer in DestroyBilateralTLS when memory allocation fails. The vulnerability is rated with a CVSS v3.1 base score of 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) and is associated with CWE-763 (Release of Invalid Pointer or Reference). It was published on 2026-01-20.
An unauthenticated attacker can exploit this vulnerability over the network without user interaction, though it requires high attack complexity. Successful exploitation results in high availability impact, such as denial-of-service via application crashes from invalid memory handling, and low integrity impact, potentially allowing limited data tampering without confidentiality loss or scope change.
ImageMagick's security advisory (GHSA-39h3-g67r-7g3c) and the patching commit (3e0330721020e0c5bb52e4b77c347527dd71658e) confirm that version 7.1.2-13 addresses the issue by properly initializing the buffer elements in AcquireBilateralTLS, preventing the invalid pointer release. Security practitioners should update to 7.1.2-13 or later to mitigate the vulnerability.
Details
- CWE(s)