Out-of-bounds write in ImageMagick - CVE-2026-48724

Vulnerability identifier: #VU133106

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-48724

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in the Floyd-Steinberg depth dithering functionality when processing a crafted image with a mask. A remote attacker can trick the victim into opening a crafted image to cause a denial of service.

User interaction is required to open or process a crafted image.

ImageMagick
Debian Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Desktop Applications Module
Development Tools Module
openEuler
Anolis OS
ImageMagick-c++
ImageMagick-c++-devel
ImageMagick-debuginfo
ImageMagick-debugsource
ImageMagick-devel
ImageMagick-perl
ImageMagick-help
ImageMagick
imagemagick (Debian package)
libMagickWand-7_Q16HDRI10
perl-PerlMagick
libMagick++-devel
ImageMagick-config-7-upstream-limited
libMagickCore-7_Q16HDRI10-debuginfo
ImageMagick-config-7-SUSE
ImageMagick-config-7-upstream-open
libMagick++-7_Q16HDRI5-debuginfo
ImageMagick-config-7-upstream-secure
ImageMagick-config-7-upstream-websafe
perl-PerlMagick-debuginfo
libMagickCore-7_Q16HDRI10
libMagick++-7_Q16HDRI5
libMagickWand-7_Q16HDRI10-debuginfo
ImageMagick-libs
ImageMagick-doc
ImageMagick-djvu

Install security update from vendor's website.

ImageMagick - update to 7.1.2-24
ImageMagick-c++ - update to 6.9.13.49-1
ImageMagick-c++-devel - update to 6.9.13.49-1
ImageMagick-debuginfo - update to 6.9.13.49-1
ImageMagick-debugsource - update to 6.9.13.49-1
ImageMagick-devel - update to 6.9.13.49-1
ImageMagick-perl - update to 6.9.13.49-1
ImageMagick-help - update to 6.9.13.49-1
ImageMagick - update to 6.9.13.49-1
imagemagick (Debian package) - update to 8:7.1.1.43+dfsg1-1+deb13u10
libMagickWand-7_Q16HDRI10 - update to 7.1.1.43-150700.3.65.1
perl-PerlMagick - update to 7.1.1.43-150700.3.65.1
libMagick++-devel - update to 7.1.1.43-150700.3.65.1
ImageMagick-config-7-upstream-limited - update to 7.1.1.43-150700.3.65.1
libMagickCore-7_Q16HDRI10-debuginfo - update to 7.1.1.43-150700.3.65.1
ImageMagick-config-7-SUSE - update to 7.1.1.43-150700.3.65.1
ImageMagick-config-7-upstream-open - update to 7.1.1.43-150700.3.65.1
libMagick++-7_Q16HDRI5-debuginfo - update to 7.1.1.43-150700.3.65.1
ImageMagick-devel - update to 7.1.1.43-150700.3.65.1
ImageMagick-config-7-upstream-secure - update to 7.1.1.43-150700.3.65.1
ImageMagick - update to 7.1.1.43-150700.3.65.1
ImageMagick-config-7-upstream-websafe - update to 7.1.1.43-150700.3.65.1
perl-PerlMagick-debuginfo - update to 7.1.1.43-150700.3.65.1
libMagickCore-7_Q16HDRI10 - update to 7.1.1.43-150700.3.65.1
libMagick++-7_Q16HDRI5 - update to 7.1.1.43-150700.3.65.1
ImageMagick-debugsource - update to 7.1.1.43-150700.3.65.1
ImageMagick-debuginfo - update to 7.1.1.43-150700.3.65.1
libMagickWand-7_Q16HDRI10-debuginfo - update to 7.1.1.43-150700.3.65.1
ImageMagick-perl - update to 7.1.2.15-12
ImageMagick-libs - update to 7.1.2.15-12
ImageMagick-doc - update to 7.1.2.15-12
ImageMagick-djvu - update to 7.1.2.15-12
ImageMagick-devel - update to 7.1.2.15-12
ImageMagick-c++-devel - update to 7.1.2.15-12
ImageMagick-c++ - update to 7.1.2.15-12
ImageMagick - update to 7.1.2.15-12

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2hhq-c99x-492r

• Multiple vulnerabilities in ImageMagick
• openEuler update for ImageMagick
• Debian update for imagemagick
• Anolis OS update for ImageMagick
• SUSE update for ImageMagick