CVE-2026-22770: 
C# vulnerability analysis and mitigation

CVE-2026-22770 is a Release of Invalid Pointer vulnerability (CWE-763) in ImageMagick's BilateralBlurImage method. When memory allocation fails inside AcquireBilateralTLS, the last element of the allocated double-buffer set is not properly initialized, causing DestroyBilateralTLS to release an invalid pointer. All ImageMagick versions prior to 7.1.2-13 are affected. The vulnerability was published on January 19–20, 2026. CVSS scores differ by source: NVD assigns 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), while the CNA (GitHub/ImageMagick) assigns 6.5 Medium (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) (GitHub Advisory, Red Hat CVE).

The root cause is an off-by-one initialization error in MagickCore/effect.c. The AcquireBilateralTLS function allocates number_threads + 1 pointer slots but only zeroed number_threads entries via memset, leaving the last pointer uninitialized. When a subsequent per-thread memory allocation fails, DestroyBilateralTLS iterates over all slots including the uninitialized last entry and attempts to free it, resulting in a release of an invalid (garbage) pointer (CWE-763). The fix (commit 3e03307) corrects the memset call to cover (number_threads+1)*sizeof(*weights) and adds a heap overflow sanity check via HeapOverflowSanityCheckGetSize before the allocation (GitHub Commit, GitHub Advisory). The attack vector is network-accessible since ImageMagick is commonly invoked server-side to process user-supplied images; an attacker can trigger the vulnerable code path by submitting a crafted image that causes the bilateral blur operation to encounter a memory allocation failure.

Successful exploitation can cause application crashes (denial of service) through the invalid pointer release, and may lead to memory corruption that could potentially be leveraged for further impact on integrity and availability. The CNA's assessment limits confidentiality impact to none, with low integrity and high availability impact, reflecting the primary risk of service disruption. Applications and web services that process user-supplied images using ImageMagick's bilateral blur functionality are most at risk, and crashes could affect availability of dependent services (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.04%, indicating a very low probability of exploitation in the near term. Exploitation requires triggering a memory allocation failure during bilateral blur processing, which adds complexity and aligns with the CNA's High attack complexity rating.

Upgrade ImageMagick to version 7.1.2-13 or later, which contains the corrected memset initialization and overflow check (GitHub Advisory, GitHub Commit). Users of the Magick.NET .NET wrapper should upgrade to version 14.10.2 or later, which bundles ImageMagick 7.1.2-13 (Magick.NET Release). As a workaround where patching is not immediately possible, restrict or disable processing of user-supplied images through the bilateral blur operation, or enforce ImageMagick security policies to limit resource consumption and untrusted input handling.

Red Hat has tracked the vulnerability and published a CVE advisory page, though no specific Red Hat product advisory has been issued (Red Hat CVE). Debian issued a security advisory (DSA-6111-1) covering ImageMagick updates that include this fix, and SUSE Linux also released updates addressing the vulnerability (Linux Security). Community reaction has been limited given the moderate real-world severity; no notable researcher commentary or significant social media discussion has been identified beyond routine CVE tracking.