CVE-2026-27798
📋 TL;DR
ImageMagick versions prior to 7.1.2-15 and 6.9.13-40 contain a heap buffer over-read vulnerability when processing images with small dimensions using the -wavelet-denoise operator. This could allow attackers to read sensitive memory contents or cause denial of service. Users and applications that process untrusted images with ImageMagick are affected.
💻 Affected Systems
- ImageMagick
- Magick.NET
- Any software using vulnerable ImageMagick libraries
📦 What is this software?
Imagemagick by Imagemagick
Imagemagick by Imagemagick
Magick.net by Dlemstra
⚠️ Risk & Real-World Impact
Worst Case
Information disclosure through memory leakage, potentially exposing sensitive data like credentials or encryption keys, or application crash leading to denial of service.
Likely Case
Application instability or crash when processing specially crafted images with the wavelet-denoise operator, causing denial of service.
If Mitigated
Minimal impact if proper input validation and sandboxing are implemented, with crashes contained to isolated processes.
🎯 Exploit Status
Exploitation requires crafting a malicious image file and triggering the vulnerable operator. No public exploits have been reported.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ImageMagick 7.1.2-15, 6.9.13-40
Vendor Advisory: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qpgx-jfcq-r59f
Restart Required: Yes
Instructions:
1. Update ImageMagick to version 7.1.2-15 or 6.9.13-40 or later. 2. For Magick.NET users, update to version 14.10.3 or later. 3. Restart any services or applications using ImageMagick.
🔧 Temporary Workarounds
Disable wavelet-denoise operator
allPrevent usage of the vulnerable -wavelet-denoise operator in ImageMagick configurations
Edit ImageMagick policy.xml to add: <policy domain="coder" rights="none" pattern="WAVELET_DENOISE" />
Input validation
allReject or sanitize image files with extremely small dimensions before processing
Implement pre-processing checks to ensure image dimensions meet minimum thresholds
🧯 If You Can't Patch
- Implement strict input validation to reject images with suspiciously small dimensions
- Sandbox ImageMagick processes to limit potential impact of crashes or memory leaks
🔍 How to Verify
Check if Vulnerable:
Check ImageMagick version with: convert --version | grep VersionCheck Version:
convert --versionVerify Fix Applied:
Verify version is 7.1.2-15/6.9.13-40 or later, or test with a known problematic image using wavelet-denoise📡 Detection & Monitoring
Log Indicators:
- ImageMagick process crashes or segmentation faults
- Unusual memory access patterns in application logs
Network Indicators:
- Uploads of image files followed by application instability
SIEM Query:
source="*imagick*" AND (event="segfault" OR event="crash")