CVE-2026-30936: 
C# vulnerability analysis and mitigation

CVE-2026-30936 is a heap-based buffer overflow vulnerability in ImageMagick's WaveletDenoiseImage method, classified as "Heap Buffer Overflow in WaveletDenoiseImage." A remote attacker can exploit this flaw by supplying a specially crafted image that, when processed with the -wavelet-denoise operation, triggers an out-of-bounds heap write, resulting in a denial of service (DoS). Affected versions include ImageMagick prior to 6.9.13-41 (6.x branch) and 7.0.0-0 through 7.1.2-15 (7.x branch), as well as Magick.NET NuGet packages prior to 14.10.4. The vulnerability was published on March 9, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat).

The root cause is an out-of-bounds heap write (CWE-787 / CWE-122) within the WaveletDenoiseImage function in ImageMagick's image processing pipeline. When a maliciously crafted image is processed using the -wavelet-denoise operation, insufficient bounds checking allows a write of 4 bytes beyond the allocated heap buffer, as confirmed by AddressSanitizer output showing a heap-buffer-overflow at address 0x503000002754 (GitHub Advisory). Exploitation requires local access and user interaction — specifically, a user must open or process the attacker-supplied image — and no elevated privileges are needed. The vulnerability was reported by researcher "Taardisaa" (GitHub Advisory).

Successful exploitation causes application instability or a crash, resulting in a denial of service (DoS) condition with high availability impact. There is no impact on confidentiality or data integrity, as the vulnerability does not expose sensitive data or allow unauthorized modification of information. The scope is limited to the affected ImageMagick process; lateral movement or privilege escalation are not directly enabled by this vulnerability (Red Hat, GitHub Advisory).

1. Craft a malicious image: Create a specially crafted image file (e.g., a manipulated raster image) designed to trigger an out-of-bounds write in the WaveletDenoiseImage function when processed by ImageMagick.
2. Deliver the image to the target: Distribute the crafted image to a user or system that processes images with ImageMagick — for example, via email attachment, file upload to a web service, or shared storage.
3. Trigger processing with -wavelet-denoise: The target user or an automated pipeline must invoke ImageMagick with the -wavelet-denoise operation on the crafted image (e.g., convert malicious.img -wavelet-denoise 0.1 output.img).
4. Trigger heap buffer overflow: The malformed image data causes an out-of-bounds write of 4 bytes in the heap during wavelet denoising, corrupting adjacent memory.
5. Achieve DoS: The memory corruption causes ImageMagick to crash or become unstable, resulting in a denial of service for the affected application or pipeline (GitHub Advisory, Red Hat).

• Logs: Application or system logs showing ImageMagick crashes or abnormal termination when processing specific image files; AddressSanitizer output referencing heap-buffer-overflow in WaveletDenoiseImage.
• Process: Unexpected crashes or core dumps from the convert, magick, or related ImageMagick processes, particularly when the -wavelet-denoise flag is used.
• File System: Presence of unusual or unexpected image files (e.g., with malformed headers or anomalous file sizes) submitted to image processing directories or upload endpoints.
• Network: Repeated delivery of image files from external or untrusted sources to systems running ImageMagick with wavelet denoising enabled.

Upgrade ImageMagick to version 7.1.2-16 or later (7.x branch) or 6.9.13-41 or later (6.x branch); Magick.NET NuGet users should upgrade to version 14.10.4 or later (GitHub Advisory, Red Hat Bugzilla). As a workaround, disable or restrict use of the -wavelet-denoise operation if it is not required for business operations. Additionally, implement input validation and sandboxing for image processing pipelines, and educate users not to process untrusted image files with ImageMagick. Linux distribution users (Debian, SUSE, Amazon Linux 2) should apply vendor-provided security updates as they become available.

The vulnerability was published by ImageMagick maintainer "dlemstra" via a GitHub Security Advisory on March 9, 2026, and was subsequently tracked by Red Hat's Product Security team via Bugzilla (GitHub Advisory, Red Hat Bugzilla). Multiple Linux distributions including Debian, SUSE, and Amazon Linux 2 have issued security advisories and package updates. Detection plugins have been published by Tenable (Nessus) and Qualys, indicating broad scanner coverage. Community reaction has been routine given the moderate severity and DoS-only impact.