ImageMagick vulnerable to Release of Invalid Pointer in BilateralBlur when memory allocation fails

A vulnerability exists in ImageMagick's BilateralBlurImage method, versions prior to 7.1.2-13. The AcquireBilateralTLS function allocates a set of double buffers, but the last element in this set is not properly initialized. When a subsequent memory allocation fails, the cleanup routine (DestroyBilateralTLS) attempts to release this uninitialized element, resulting in the release of an invalid pointer [2][3].

An attacker could exploit this by providing a specially crafted image that triggers the memory allocation failure while BilateralBlurImage is processing. Since ImageMagick is often used in server-side image processing or automation pipelines, an attacker may deliver the image remotely (e.g., via upload or URL) without requiring authentication. No user interaction beyond opening or processing the image is needed to trigger the defect [3][4].

The release of an invalid pointer can lead to undefined behavior, typically causing an application crash (denial of service). In worst-case scenarios, memory corruption might be possible, but the advisory does not explicitly prove code execution. The issue is fixed in ImageMagick version 7.1.2-13, which was released on 2026-01-19 and incorporated into downstream libraries such as Magick.NET 14.10.2 [4]. Users should upgrade to the patched version or apply the vendor-supplied patch.