CVE-2026-22770

ImageMagick is free and open-source software used for editing and manipulating digital images. The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But, in versions prior to 7.1.2-13, the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails. Version 7.1.2-13 contains a patch for the issue.

• CWE-763

• https://github.com/ImageMagick/ImageMagick/commit/3e0330721020e0c5bb52e4b77c347527dd71658ePatch
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-39h3-g67r-7g3cVendor Advisory

Published

Jan 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22765Dell Wyse Management Suite, versions prior to WMS 5.5, conta…8.8
• CVE-2026-22766Dell Wyse Management Suite, versions prior to WMS 5.5, conta…7.2
• CVE-2026-22767Dell AppSync, version(s) 4.6.0, contain(s) an UNIX Symbolic …7.3
• CVE-2026-22768Dell AppSync, version(s) 4.6.0, contain(s) an Incorrect Perm…7.3
• CVE-2026-22769Dell RecoverPoint for Virtual Machines, versions prior to 6.…10
• CVE-2026-2277The rexCrawler plugin for WordPress is vulnerable to Reflect…6.1
• CVE-2026-22771Envoy Gateway is an open source project for managing Envoy P…8.8
• CVE-2026-22772Fulcio is a certificate authority for issuing code signing c…5.3
• CVE-2026-22773vLLM is an inference and serving engine for large language m…7.5
• CVE-2026-22774Svelte devalue is a JavaScript library that serializes value…7.5
• CVE-2026-22775Svelte devalue is a JavaScript library that serializes value…7.5
• CVE-2026-22776cpp-httplib is a C++11 single-file header-only cross platfor…7.5