CVE-2026-48724 describes a heap buffer underwrite vulnerability in the Floyd-Steinberg depth dithering method of ImageMagick's Magick.NET-Q16-AnyCPU component. When an image with a mask is processed using this dithering method, a negative heap buffer overwrite can occur, which may cause memory corruption and impact application availability. The vulnerability has a CVSS 3.1 vector of AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating local attack vector with low complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality or integrity impact, but high impact on availability. The affected versions are all versions before 14.14.0. There is no indication of known exploits in the wild or available patches.

The vulnerability can cause a heap buffer underwrite leading to potential application crashes or denial of service. There is no reported impact on confidentiality or integrity. The attack requires local access and user interaction, limiting the attack surface. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing images with masks using the Floyd-Steinberg depth dithering method in affected versions. Monitor vendor channels for updates and apply patches once released.