CVE-2026-27798: 
C# vulnerability analysis and mitigation

CVE-2026-27798 is a heap buffer over-read vulnerability in ImageMagick's WaveletDenoiseImage function, triggered when processing images with small dimensions using the -wavelet-denoise operator. It was disclosed on February 24, 2026, and affects ImageMagick versions prior to 7.1.2-15 and 6.9.13-40, as well as the Magick.NET .NET wrapper prior to version 14.10.3. The vulnerability carries a CVSS v3.1 base score of 4.0 (Moderate) per the GitHub Security Advisory, though Feedly's NVD-sourced data assigns a higher score of 7.1 (High) reflecting different scoring assumptions (Github Advisory, ImageMagick Advisory).

The root cause is an insufficient memory allocation in MagickCore/visual-effects.c within the WaveletDenoiseImage function (CWE-125: Out-of-bounds Read; CWE-126: Buffer Over-read). Specifically, the buffer was allocated using 3*image->columns rows instead of the required 4*image->columns, causing a 4-byte heap over-read when processing images whose dimensions are too small for the wavelet decomposition algorithm to operate within the allocated buffer bounds. The fix, committed as 0377e60, corrects the multiplier from 3 to 4 in the AcquireVirtualMemory call (ImageMagick Commit, ImageMagick Advisory). Exploitation requires a locally accessible attacker (or a crafted image submitted to a service) with no user interaction needed beyond invoking the -wavelet-denoise operator on a specially crafted small-dimension image.

Successful exploitation results in a heap buffer over-read, primarily impacting confidentiality by potentially exposing adjacent heap memory contents to an attacker — this could include sensitive data processed by the application. Integrity is not directly affected, and availability impact is limited to potential application crashes due to the memory safety violation. In environments where ImageMagick processes user-supplied images (e.g., web services, document pipelines), the risk of information disclosure from heap memory is the primary concern (Github Advisory, Red Hat Bugzilla).

1. Craft a malicious image: Create an image file with very small dimensions (e.g., 1x1 or similarly tiny pixel dimensions) using any image creation tool.
2. Target a vulnerable system: Identify a system running ImageMagick versions prior to 7.1.2-15 or 6.9.13-40, or Magick.NET prior to 14.10.3, that processes user-supplied images with the -wavelet-denoise operator.
3. Submit the crafted image: Supply the small-dimension image to the target system — either directly via command line (convert tiny.png -wavelet-denoise 0.1 output.png) or through an application interface that invokes ImageMagick with wavelet denoising.
4. Trigger the over-read: The WaveletDenoiseImage function allocates a buffer using 3*image->columns instead of 4*image->columns, causing a 4-byte read beyond the allocated heap buffer during wavelet decomposition.
5. Observe leaked memory or crash: Depending on heap layout, the over-read may expose adjacent heap memory contents (potential information disclosure) or cause an application crash (ImageMagick Advisory, ImageMagick Commit).

• Logs: Application or system logs showing AddressSanitizer (ASan) errors referencing heap-buffer-overflow in WaveletDenoiseImage or visual-effects.c; crash reports with stack traces pointing to MagickCore/visual-effects.c around line 3569.
• Process: Unexpected termination (segfault/SIGABRT) of ImageMagick processes (convert, magick) when processing small-dimension images with -wavelet-denoise.
• File System: Presence of very small-dimension image files (e.g., 1x1 pixels) submitted to image processing queues or upload directories, particularly if combined with wavelet denoising operations.
• Network: In web-facing deployments, HTTP requests uploading unusually small image files to endpoints that invoke ImageMagick with denoising filters (Github Advisory).

Upgrade ImageMagick to version 7.1.2-15 or later (for the 7.x branch) or 6.9.13-40 or later (for the 6.x branch). Magick.NET users should upgrade to version 14.10.3 or later. As a workaround where patching is not immediately possible, restrict or disable use of the -wavelet-denoise operator on untrusted or user-supplied images, and enforce minimum image dimension requirements before processing. Distribution-specific patches have been issued for Debian, SUSE, and Amazon Linux 2 (ImageMagick Advisory, Magick.NET Release, Red Hat Bugzilla).

The vulnerability was reported by security researcher ylwango613 and patched promptly by the ImageMagick maintainers. Red Hat tracked the issue via Bugzilla and classified it as medium severity for information disclosure. Distribution vendors including Debian, SUSE, and Amazon Linux issued security updates incorporating the fix. No significant broader media coverage or notable social media discussion has been observed beyond standard vulnerability tracking channels (ImageMagick Advisory, Red Hat Bugzilla).