CVE-2026-34238: 
C# vulnerability analysis and mitigation

CVE-2026-34238 is an integer overflow vulnerability in ImageMagick's despeckle operation that causes a heap buffer overflow on 32-bit builds, resulting in an out-of-bounds write. It affects ImageMagick versions below 6.9.13-44 (6.x branch) and below 7.1.2-19 (7.x branch), as well as Magick.NET NuGet packages below version 14.12.0. The vulnerability was disclosed on April 13, 2026, by researcher shitianyu-2004 via the GitHub Advisory Database. It carries a CVSS v3.1 base score of 5.1 (Moderate) per the GitHub advisory, or 5.5 (Medium) per NVD scoring (Github Advisory, ImageMagick Advisory).

The root cause is an integer overflow (CWE-190) in the DespeckleImage function within MagickCore/effect.c, where the buffer length calculation (image->columns + 2) * (image->rows + 2) can overflow on 32-bit builds when image dimensions are sufficiently large, leading to an undersized heap allocation and a subsequent out-of-bounds write (CWE-787). The fix adds explicit bounds checks to ensure image->columns and image->rows do not exceed MAGICK_SIZE_MAX - 2 before performing the multiplication (ImageMagick Commit). The vulnerability is limited to 32-bit builds; 64-bit builds are not affected because the larger integer width prevents the overflow condition. AddressSanitizer output confirms a heap-buffer-overflow WRITE of size 8 at the point of the despeckle buffer allocation (Github Advisory).

Successful exploitation results in a heap buffer overflow write, which can crash the ImageMagick process, causing a denial of service (availability impact: High). There is no assessed confidentiality or integrity impact based on current scoring. The vulnerability is constrained to 32-bit builds and requires processing a specially crafted image with large dimensions through the despeckle operation, limiting its practical scope to environments running 32-bit ImageMagick or Magick.NET x86 packages (Github Advisory, ImageMagick Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-34238. The EPSS score is approximately 0.017% (0.000120 per Feedly data), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Github Advisory).

Users should upgrade ImageMagick to version 7.1.2-19 or later (7.x branch) or 6.9.13-44 or later (6.x branch) to remediate this vulnerability. Magick.NET users should upgrade to version 14.12.0 or later, which bundles the patched ImageMagick release. As a workaround where upgrading is not immediately possible, avoid processing untrusted images through the despeckle operation on 32-bit deployments, or migrate to 64-bit builds where the integer overflow condition cannot occur (ImageMagick Release, Magick.NET Release, ImageMagick Advisory).

The vulnerability was published by maintainer dlemstra via the GitHub Advisory Database on April 13, 2026, and was picked up by downstream Linux distribution security teams including openSUSE and Debian, which issued their own advisories and package updates. Red Hat also tracked the issue via Bugzilla. Coverage has been limited to routine vulnerability aggregation sites and Linux security news outlets, with no notable researcher commentary or significant social media discussion beyond automated CVE feeds (Red Hat Bugzilla, Github Advisory).