CVE-2026-30935

A flaw was found in ImageMagick. Processing a specially crafted image with the -bilateral-blur operation in the BilateralBlurImage function can cause a heap-based buffer over-read due to an incorrect conversion, leading to a denial of service.

To exploit this flaw, an attacker needs to convince a user to process a specially crafted image with the -bilateral-blur operation. Additionally, this issue can cause a heap-based buffer over-read of only 4 bytes, limiting the security impact to a denial of service. Due to these reasons, this vulnerability has been rated with a moderate severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To reduce the risk of exploitation, avoid processing untrusted image files using the -bilateral-blur operation with ImageMagick. If ImageMagick is deployed in a way that it processes files from untrusted sources automatically, consider running the application inside a container or a restricted sandbox environment to limit the potential security impact.