Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-22770: magick.net image handling may allow code execution
CVE-2026-22770 · published 9 days ago
Summary
The magick.net libraries for various platforms can be tricked into running unwanted code when processing specially crafted image files. This could let an attacker take control of the system that processes those images. Update to the latest patched versions of the magick.net packages as soon as possible.
What to do
- Update dirk lemstra magick.net-q8-x64 to version 14.10.2.
- Update dirk lemstra magick.net-q8-arm64 to version 14.10.2.
- Update dirk lemstra magick.net-q8-x86 to version 14.10.2.
- Update dirk lemstra magick.net-q8-openmp-x64 to version 14.10.2.
- Update dirk lemstra magick.net-q8-openmp-arm64 to version 14.10.2.
- Update dirk lemstra magick.net-q16-x64 to version 14.10.2.
- Update dirk lemstra magick.net-q16-arm64 to version 14.10.2.
- Update dirk lemstra magick.net-q16-x86 to version 14.10.2.
- Update dirk lemstra magick.net-q16-openmp-x64 to version 14.10.2.
- Update dirk lemstra magick.net-q16-openmp-arm64 to version 14.10.2.
- Update magick.net-q16-openmp-x86 to version 14.10.2.
- Update dirk lemstra magick.net-q16-hdri-x64 to version 14.10.2.
- Update dirk lemstra magick.net-q16-hdri-arm64 to version 14.10.2.
- Update dirk lemstra magick.net-q16-hdri-x86 to version 14.10.2.
- Update dirk lemstra magick.net-q16-hdri-openmp-x64 to version 14.10.2.
- Update dirk lemstra magick.net-q16-hdri-openmp-arm64 to version 14.10.2.
- Update dirk lemstra magick.net-q8-anycpu to version 14.10.2.
- Update dirk lemstra magick.net-q16-anycpu to version 14.10.2.
- Update dirk lemstra magick.net-q16-hdri-anycpu to version 14.10.2.
- Update debian imagemagick to version 8:7.1.1.43+dfsg1-1+deb13u5.
- Update debian imagemagick to version 8:7.1.2.13+dfsg1-1.
- Update debian rootio-imagemagick to version 8:6.9.11.60+dfsg-1.6+deb12u5.root.io.20.
- Update imagemagick to version 7.1.2.30-r00071.
- Update rootio-imagemagick to version 7.1.2.30-r00071.
- Update imagemagick imagemagick to version 7.1.2-13 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| nuget | dirk lemstra | magick.net-q8-x64 |
< 14.10.2 Fix: upgrade to 14.10.2
|
| nuget | dirk lemstra | magick.net-q8-arm64 |
< 14.10.2 Fix: upgrade to 14.10.2
|
| nuget | dirk lemstra | magick.net-q8-x86 |
< 14.10.2 Fix: upgrade to 14.10.2
|
| nuget | dirk lemstra | magick.net-q8-openmp-x64 |
< 14.10.2 Fix: upgrade to 14.10.2
|
| nuget | dirk lemstra | magick.net-q8-openmp-arm64 |
< 14.10.2 Fix: upgrade to 14.10.2
|
| nuget | dirk lemstra | magick.net-q16-x64 |
< 14.10.2 Fix: upgrade to 14.10.2
|
| nuget | dirk lemstra | magick.net-q16-arm64 |
< 14.10.2 Fix: upgrade to 14.10.2
|
| nuget | dirk lemstra | magick.net-q16-x86 |
< 14.10.2 Fix: upgrade to 14.10.2
|
| nuget | dirk lemstra | magick.net-q16-openmp-x64 |
< 14.10.2 Fix: upgrade to 14.10.2
|
| nuget | dirk lemstra | magick.net-q16-openmp-arm64 |
< 14.10.2 Fix: upgrade to 14.10.2
|
| nuget | – | magick.net-q16-openmp-x86 |
< 14.10.2 Fix: upgrade to 14.10.2
|
| nuget | dirk lemstra | magick.net-q16-hdri-x64 |
< 14.10.2 Fix: upgrade to 14.10.2
|
| nuget | dirk lemstra | magick.net-q16-hdri-arm64 |
< 14.10.2 Fix: upgrade to 14.10.2
|
| nuget | dirk lemstra | magick.net-q16-hdri-x86 |
< 14.10.2 Fix: upgrade to 14.10.2
|
| nuget | dirk lemstra | magick.net-q16-hdri-openmp-x64 |
< 14.10.2 Fix: upgrade to 14.10.2
|
| nuget | dirk lemstra | magick.net-q16-hdri-openmp-arm64 |
< 14.10.2 Fix: upgrade to 14.10.2
|
| nuget | dirk lemstra | magick.net-q8-anycpu |
< 14.10.2 Fix: upgrade to 14.10.2
|
| nuget | dirk lemstra | magick.net-q16-anycpu |
< 14.10.2 Fix: upgrade to 14.10.2
|
| nuget | dirk lemstra | magick.net-q16-hdri-anycpu |
< 14.10.2 Fix: upgrade to 14.10.2
|
| – | imagemagick | imagemagick |
< 7.1.2-13 cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* |
| Debian:13 | debian | imagemagick |
< 8:7.1.1.43+dfsg1-1+deb13u5 Fix: upgrade to 8:7.1.1.43+dfsg1-1+deb13u5
|
| Debian:14 | debian | imagemagick |
< 8:7.1.2.13+dfsg1-1 Fix: upgrade to 8:7.1.2.13+dfsg1-1
|
| Root:Debian:12 | debian | rootio-imagemagick |
< 8:6.9.11.60+dfsg-1.6+deb12u5.root.io.20 Fix: upgrade to 8:6.9.11.60+dfsg-1.6+deb12u5.root.io.20
|
| Root:Alpine:3.24 | – | imagemagick |
< 7.1.2.30-r00071 Fix: upgrade to 7.1.2.30-r00071
|
| Root:Alpine:3.24 | – | rootio-imagemagick |
< 7.1.2.30-r00071 Fix: upgrade to 7.1.2.30-r00071
|
Original advisory text
CVE-2026-22770 in imagemagick - Patched by Root
Root has patched CVE-2026-22770 in the imagemagick package for Root:Alpine:3.24. Multiple fixed versions available.
References
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-39h3-g67r-7g...
- https://nvd.nist.gov/vuln/detail/CVE-2026-22770
- https://github.com/ImageMagick/ImageMagick/commit/3e0330721020e0c5bb52e4b77c3475...
- https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2
- https://github.com/advisories/GHSA-39h3-g67r-7g3c
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22770... Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-22770 Vendor Advisory
Severity
9.8
Critical
CVSS 3.1: 6.5 (GHSA)
CVSS 3.1: 9.8 (OSV)
Exploitation
EPSS <1%
Type
CWE-763Release of Invalid Pointer or Reference
Timeline
Published14 Sep 2026
Updated22 Sep 2026
First seen6 Mar 2026
Sources
GHSA-39h3-g67r-7g3c · GHSA
CVE-2026-22770 · NVD
CVE-2026-22770 · OSV
DEBIAN-CVE-2026-22770 · OSV
Track software like this
Free during beta