ImageMagick EUVD-2026-22112

The root cause is CWE-190 (Integer Overflow or Wraparound) in the DespeckleImage() function within MagickCore/effect.c. On 32-bit platforms, size_t is a 32-bit type, so the expression (image->columns+2)*(image->rows+2) can silently wrap around when image dimensions are sufficiently large, producing a value far smaller than the actual required allocation size. The resulting undersized heap buffer is then written beyond its boundary, as confirmed by the AddressSanitizer trace showing a WRITE of size 8 past the allocation. The upstream fix (commit bcd8519c70ecd9ebbc180920f2cf97b267d1f440) adds explicit pre-multiplication bounds checking against MAGICK_SIZE_MAX before computing length and removes the lossy (size_t) cast. Affected packages span multiple Magick.NET NuGet variants - Q8/Q16 in AnyCPU and x86 configurations - meaning AnyCPU packages are vulnerable when the runtime is 32-bit (x86 process). 64-bit builds are structurally immune because size_t is 64 bits and the overflow cannot occur at any realistic image dimension.