ImageMagick has a heap Buffer Over-Read in BilateralBlurImage

CVE-2026-30935 is a heap buffer over-read vulnerability in ImageMagick's BilateralBlurImage function, caused by an incorrect conversion during image processing [2]. The bug exists prior to version 7.1.2-16 and can be triggered when a user applies the -bilateral-blur operation on a specially crafted image.

Exploitation requires an attacker to supply a malicious image to a system using ImageMagick, either via command-line invocation or through applications that rely on the library [4]. No authentication is needed if the processing is automated. The vulnerability results in an out-of-bounds read, which may expose sensitive heap memory or lead to a crash.

An attacker could potentially use the information disclosed by the read to bypass memory protections or gather internal data. While the advisory does not confirm code execution, such over-reads can be exploited in combination with other bugs [1]. The issue is fixed in ImageMagick 7.1.2-16, released on March 8, 2026, and downstream projects like Magick.NET have been updated accordingly [3].