Cyber Posture

CVE-2026-22770

Medium

Published: 20 January 2026

Published
20 January 2026
Modified
29 January 2026
KEV Added
Patch
CVSS Score 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
EPSS Score 0.0007 20.7th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-22770 is a medium-severity Release of Invalid Pointer or Reference (CWE-763) vulnerability in Imagemagick Imagemagick. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 20.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Application or System Exploitation (T1499.004).
Threat & Defense Details

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Memory corruption in image library directly enables remote application exploitation resulting in DoS via crash (high availability impact).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

ImageMagick is free and open-source software used for editing and manipulating digital images. The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But, in versions prior to 7.1.2-13, the last element in the set is not properly…

more

initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails. Version 7.1.2-13 contains a patch for the issue.

Deeper analysisAI

CVE-2026-22770 is a memory safety vulnerability in ImageMagick, a free and open-source software suite for editing and manipulating digital images. The issue affects versions prior to 7.1.2-13 and resides in the BilateralBlurImage method, which allocates a set of double buffers via AcquireBilateralTLS. In vulnerable versions, the last element in this set is not properly initialized, leading to the release of an invalid pointer in DestroyBilateralTLS when memory allocation fails. The vulnerability is rated with a CVSS v3.1 base score of 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) and is associated with CWE-763 (Release of Invalid Pointer or Reference). It was published on 2026-01-20.

An unauthenticated attacker can exploit this vulnerability over the network without user interaction, though it requires high attack complexity. Successful exploitation results in high availability impact, such as denial-of-service via application crashes from invalid memory handling, and low integrity impact, potentially allowing limited data tampering without confidentiality loss or scope change.

ImageMagick's security advisory (GHSA-39h3-g67r-7g3c) and the patching commit (3e0330721020e0c5bb52e4b77c347527dd71658e) confirm that version 7.1.2-13 addresses the issue by properly initializing the buffer elements in AcquireBilateralTLS, preventing the invalid pointer release. Security practitioners should update to 7.1.2-13 or later to mitigate the vulnerability.

Details

CWE(s)

Affected Products

imagemagick
imagemagick
≤ 7.1.2-13

CVEs Like This One

CVE-2026-33908Same product: Imagemagick Imagemagick
CVE-2026-25799Same product: Imagemagick Imagemagick
CVE-2026-25989Same product: Imagemagick Imagemagick
CVE-2026-25795Same product: Imagemagick Imagemagick
CVE-2026-28691Same product: Imagemagick Imagemagick
CVE-2026-26283Same product: Imagemagick Imagemagick
CVE-2026-30883Same product: Imagemagick Imagemagick
CVE-2026-25971Same product: Imagemagick Imagemagick
CVE-2026-26066Same product: Imagemagick Imagemagick
CVE-2026-25796Same product: Imagemagick Imagemagick

References