CVE-2026-22770 is a medium severity flaw (CVSS 6.5) in ImageMagick, in the BilateralBlurImage method. A buffer is left uninitialized, so a failed memory allocation leads to freeing an invalid pointer. It affects versions before 7.1.2-13. Update to 7.1.2-13 or later.
What's affected
ImageMagick versions before 7.1.2-13. The fixed version is 7.1.2-13.
The advisory describes the cause as the last element of a set of double buffers not being initialised in AcquireBilateralTLS, which DestroyBilateralTLS then frees when an allocation fails.
How to check if you're exposed
Print the version.
magick -version
convert -version
The first works on ImageMagick 7, and the second on older installs. Also check bundled copies: some apps and containers carry their own ImageMagick, and Linux distributions often backport fixes without changing the version string, so read your distribution advisory.
What to do now
- Update ImageMagick to 7.1.2-13 or later, or install the distribution package that includes the fix.
- Rebuild container images that bundle ImageMagick, and redeploy them.
- If you process untrusted images, keep resource limits in place with the policy file.
- Search your applications for libraries that wrap or call ImageMagick.
- Run a dependency scan to find copies you did not know about.
Why it matters
The weakness is CWE-763, release of an invalid pointer or reference. The failure only occurs when memory allocation fails, which explains the high attack complexity in the vector. The impact is rated as low for integrity and high for availability.
ImageMagick is widely embedded, so the useful question is where it runs in your estate and whether it handles input from outside. The record does not say the flaw is exploited in the wild, and it is not on the CISA KEV list.
Quick check
Do I need ImageMagick installed to be exposed?
Applications and images can bundle it. A software inventory shows where it is present.
Does a distro package show 7.1.2-13?
Not always. Distributions may backport the fix under an older version number, so check the distribution advisory.
Sources
Last reviewed: 19 October 2026.
