ImageMagick has a heap-based buffer overflow in UHDR encoder

Vulnerability

Overview

CVE-2026-30931 describes a heap-based buffer overflow vulnerability in the UHDR encoder of ImageMagick, a widely used open-source image processing suite [1]. The root cause is a truncation of a value during encoding, which leads to an out-of-bounds write on the heap [2]. This flaw exists in versions prior to 7.1.2-16 [2].

Exploitation and

Attack Surface

An attacker can exploit this vulnerability by providing a specially crafted image file that triggers the UHDR encoder path [4]. The attack vector is network-based, requiring no privileges and no user interaction, making it remotely exploitable [4]. The complexity is low, as the overflow occurs during normal processing of the image [4].

Impact

Successful exploitation allows an attacker to write data beyond the allocated heap buffer, potentially leading to memory corruption [2]. This can result in denial of service, or in more severe cases, arbitrary code execution depending on the heap layout and mitigations [4]. The vulnerability affects confidentiality, integrity, and availability [4].

Mitigation

The vulnerability is fixed in ImageMagick version 7.1.2-16, released on 2026-03-08 [3]. Users are strongly advised to update to this version or later [2]. No workarounds are mentioned, but applying the security policy recommendations from ImageMagick can help reduce risk [1]. The issue is also tracked as GHSA-h95r-c8c7-mrwx [4].