CVE-2026-22770
Published: 20 January 2026
Summary
CVE-2026-22770 is a medium-severity Release of Invalid Pointer or Reference (CWE-763) vulnerability in Imagemagick Imagemagick. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 25.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-2 (Baseline Configuration).
Deeper analysis
CVE-2026-22770 is a memory safety vulnerability in ImageMagick, a free and open-source software suite for editing and manipulating digital images. The issue affects versions prior to 7.1.2-13 and resides in the BilateralBlurImage method, which allocates a set of double buffers via AcquireBilateralTLS. In vulnerable versions, the last element in this set is not properly initialized, leading to the release of an invalid pointer in DestroyBilateralTLS when memory allocation fails. The vulnerability is rated with a CVSS v3.1 base score of 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) and is associated with CWE-763 (Release of Invalid Pointer or Reference). It was published on 2026-01-20.
An unauthenticated attacker can exploit this vulnerability over the network without user interaction, though it requires high attack complexity. Successful exploitation results in high availability impact, such as denial-of-service via application crashes from invalid memory handling, and low integrity impact, potentially allowing limited data tampering without confidentiality loss or scope change.
ImageMagick's security advisory (GHSA-39h3-g67r-7g3c) and the patching commit (3e0330721020e0c5bb52e4b77c347527dd71658e) confirm that version 7.1.2-13 addresses the issue by properly initializing the buffer elements in AcquireBilateralTLS, preventing the invalid pointer release. Security practitioners should update to 7.1.2-13 or later to mitigate the vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3401
Vulnerability details
ImageMagick is free and open-source software used for editing and manipulating digital images. The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But, in versions prior to 7.1.2-13, the last element in the set is not properly…
more
initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails. Version 7.1.2-13 contains a patch for the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Memory corruption in image library directly enables remote application exploitation resulting in DoS via crash (high availability impact).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification and remediation of software flaws such as the uninitialized buffer in AcquireBilateralTLS that triggers invalid pointer release in DestroyBilateralTLS.
Establishes approved system baselines that must incorporate the patched ImageMagick 7.1.2-13 release to eliminate the CWE-763 defect.
Requires verification of software integrity and authenticity, ensuring only the corrected ImageMagick binary is deployed and that tampering has not occurred.