GHSA-qpgx-jfcq-r59f | Mondoo Vulnerability Intelligence

GHSA-qpgx-jfcq-r59f

MEDIUM4.0

ImageMagick: Heap Buffer Over-read in WaveletDenoise when processing small images

Published Feb 25, 2026

Modified 5 days ago

Fix available

Details

A heap buffer over-read vulnerability occurs when processing an image with small dimension using the -wavelet-denoise operator.

==3693336==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x511000001280 at pc 0x5602c8b0cc75 bp 0x7ffcb105d510 sp 0x7ffcb105d500
READ of size 4 at 0x511000001280 thread T0

Affected Packages(19 packages)

Magick.NET-Q16-AnyCPU

NuGet

Fixed in:

14.10.3

Magick.NET-Q16-HDRI-AnyCPU

NuGet

Fixed in:

14.10.3

Magick.NET-Q16-HDRI-OpenMP-arm64

NuGet

Fixed in:

14.10.3

Magick.NET-Q16-HDRI-OpenMP-x64

NuGet

Fixed in:

14.10.3

Magick.NET-Q16-HDRI-arm64

NuGet

Fixed in:

14.10.3

Magick.NET-Q16-HDRI-x64

NuGet

Fixed in:

14.10.3

Magick.NET-Q16-HDRI-x86

NuGet

Fixed in:

14.10.3

Magick.NET-Q16-OpenMP-arm64

NuGet

Fixed in:

14.10.3

Magick.NET-Q16-OpenMP-x64

NuGet

Fixed in:

14.10.3

Magick.NET-Q16-OpenMP-x86

NuGet

Fixed in:

14.10.3

References

PACKAGE

https://github.com/ImageMagick/ImageMagick

WEB

https://github.com/ImageMagick/ImageMagick/commit/0377e60b3c0d766bd7271221c95d9ee54f6a3738

WEB

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qpgx-jfcq-r59f

ADVISORY

https://github.com/advisories/GHSA-qpgx-jfcq-r59f

WEB

https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3

ADVISORY

https://nvd.nist.gov/vuln/detail/CVE-2026-27798

Aliases

CVE-2026-27798

CVSS Analysis

CVSS v3.1

4.0

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

NoneI:N

Availability

NoneA:N

4.0/CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVE-2026-27798

Ecosystems

NuGet

Timeline

PublishedFeb 25, 2026

ModifiedFeb 27, 2026