CVE-2026-30937

A flaw was found in ImageMagick, a software suite for editing and manipulating digital images. An integer overflow vulnerability exists in the XWD (X Windows) encoder when processing extremely large images. This flaw can lead to an undersized memory allocation, resulting in an out-of-bounds write to the heap. A local attacker could exploit this to cause a denial of service (DoS) or potentially impact data integrity.

A MODERATE impact heap buffer overflow exists in ImageMagick's XWD encoder, WriteXWDImage. This flaw occurs when processing extremely large images, leading to an undersized heap buffer allocation and a potential out-of-bounds write. Red Hat products shipping ImageMagick are affected if configured to generate or convert excessively large images into the XWD format.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict ImageMagick's processing of untrusted or excessively large XWD image files. Implement input validation to ensure that image dimensions and sizes are within expected operational limits before processing them with ImageMagick.