CVE-2026-30935: 
C# vulnerability analysis and mitigation

CVE-2026-30935 is a heap buffer over-read vulnerability in ImageMagick's BilateralBlurImage function, caused by an incorrect type conversion that allows an out-of-bounds read when processing a crafted image using the -bilateral-blur operation. It affects all ImageMagick versions prior to 7.1.2-16, as well as Magick.NET NuGet packages prior to version 14.10.4. The vulnerability was published on March 9–10, 2026, and was reported by researcher Taardisaa. It carries a CVSS v3.1 base score of 4.4 (Medium) (GitHub Advisory, Github Advisory DB).

The root cause is classified as CWE-125 (Out-of-bounds Read) and CWE-190 (Integer Overflow or Wraparound), where an incorrect conversion in the BilateralBlurImage function leads to a heap buffer over-read. The attack vector is local (AV:L), requiring no privileges but necessitating user interaction — specifically, a user or automated pipeline must process a specially crafted image file with the -bilateral-blur operation. AddressSanitizer output confirms a heap-buffer-overflow READ of size 4 at an out-of-bounds heap address, indicating the integer conversion error causes the read pointer to exceed the allocated buffer boundary (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation can result in limited information disclosure — an attacker may read sensitive data from heap memory adjacent to the image buffer — and potential denial of service through application crashes. The vulnerability's scope is unchanged, meaning impact is confined to the ImageMagick process itself without privilege escalation or lateral movement potential. Integrity is not affected, and the overall risk is constrained by the requirement for local access and user interaction (GitHub Advisory, Github Advisory DB).

The primary remediation is to upgrade ImageMagick to version 7.1.2-16 or later, which contains the fix for this vulnerability. Users of Magick.NET NuGet packages should upgrade to version 14.10.4 or later across all affected package variants (Q8, Q16, HDRI, OpenMP, etc.). As a temporary workaround for systems that cannot be immediately patched, restrict or disable use of the -bilateral-blur operation and limit image processing to trusted sources only (GitHub Advisory, Github Advisory DB).

The vulnerability received routine coverage from Linux distribution security channels, including Debian, SUSE/openSUSE, and Solus, which issued advisories and package updates in the weeks following disclosure. Security scanning vendors Tenable (Nessus) and Qualys added detection plugins for the vulnerability. No significant researcher commentary or notable social media discussion beyond standard vulnerability tracking was observed (Feedly).