PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48724 ImageMagick CVE debrief

CVE-2026-48724 is a MEDIUM severity vulnerability in ImageMagick, a free and open-source software for editing and manipulating digital images. Prior to version 7.1.2-24, when using an image with mask and the Floyd-Steinberg dithering method, it causes a negative heap buffer over-write. This issue has been patched in version 7.1.2-24.

Vendor
ImageMagick
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-10
Original CVE updated
2026-06-11
Advisory published
2026-06-10
Advisory updated
2026-06-11

Who should care

Users of ImageMagick, especially those who use the Floyd-Steinberg dithering method with images that have masks, should be aware of this vulnerability and update to version 7.1.2-24 or later to mitigate the risk.

Technical summary

The vulnerability is caused by a negative heap buffer over-write when using the Floyd-Steinberg dithering method with an image that has a mask. This can be exploited by a specially crafted image, potentially leading to a denial of service or other malicious activities.

Defensive priority

MEDIUM

Recommended defensive actions

  • Update ImageMagick to version 7.1.2-24 or later.
  • Avoid using the Floyd-Steinberg dithering method with images that have masks in versions prior to 7.1.2-24.

Evidence notes

The vulnerability was patched in version 7.1.2-24 of ImageMagick.

Official resources

CVE-2026-48724 was published on 2026-06-10T23:16:48.950Z and modified on 2026-06-11T18:42:58.957Z.