CVE-2026-27799: 
C# vulnerability analysis and mitigation

CVE-2026-27799 is a heap buffer over-read vulnerability in ImageMagick's DJVU image format handler, caused by integer truncation during stride (row size) calculation for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in out-of-bounds memory reads. It affects ImageMagick versions prior to 7.1.2-15 (in the 7.x branch) and prior to 6.9.13-40 (in the 6.x branch), as well as Magick.NET (the .NET wrapper) prior to version 14.10.3. The vulnerability was published on February 24, 2026, and has a CVSS v3.1 base score of 4.0 (Moderate) (Github Advisory, GitHub Advisory DB).

The root cause is an integer truncation bug (CWE-122: Heap-based Buffer Overflow; CWE-126: Buffer Over-read; CWE-125: Out-of-bounds Read) in coders/djvu.c within the get_page_image() function. The stride variable was declared as a 32-bit signed int, and when computing the row size for large images (e.g., image->columns * 3 for color pages), the multiplication could overflow the signed integer, producing an incorrect (smaller) value. This truncated stride was then passed to AcquireQuantumMemory(), allocating an undersized buffer, and subsequent pixel data reads would access memory beyond the allocated region. The fix, committed as e87695b, corrects the type of stride from int to size_t, preventing the overflow (GitHub Commit, Github Advisory). Exploitation requires a locally accessible, specially crafted DJVU image file with dimensions large enough to trigger the integer overflow in the stride calculation.

Successful exploitation can result in denial of service (application crash due to out-of-bounds memory access) and potential data corruption, as described by Red Hat's bug tracker (bugzilla.redhat.com). There is no confidentiality impact (no data disclosure), but integrity and availability are both rated as low — meaning limited data corruption and service disruption are possible. The vulnerability is constrained to the local attack surface and does not enable remote code execution or lateral movement based on current analysis (Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-27799. The EPSS score is approximately 0.018% (5th percentile), indicating a very low probability of exploitation in the near term (GitHub Advisory DB). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack vector is local with high complexity, further reducing practical exploitability.

Users should upgrade to ImageMagick 7.1.2-15 or later (for the 7.x branch), or 6.9.13-40 or later (for the 6.x branch). Magick.NET users should upgrade to version 14.10.3 or later (Magick.NET Release). As a workaround where upgrading is not immediately possible, administrators can disable DJVU image format processing via ImageMagick's policy configuration (policy.xml) by adding a deny policy for the DJVU coder. Linux distribution users should apply vendor-provided security updates from their respective package repositories (e.g., Debian, SUSE, Amazon Linux 2) (Github Advisory).

Red Hat tracked the issue via Bugzilla (Bug 2442879), classifying it as medium severity with potential for denial of service and data corruption when processing crafted DJVU images (bugzilla.redhat.com). OpenSUSE and Debian issued security advisories and package updates addressing this CVE alongside other ImageMagick vulnerabilities. No notable independent researcher commentary or significant social media discussion has been identified for this specific CVE.