Vulnerability · Published Feb 24, 2026 · Assigned by GitHub_M
CVE-2026-25794ImageMagick has heap-buffer-overflow via signed integer overflow in `WriteUHDRImage` when writing UHDR images with large dimensions
High 8.2
In plain English
A high-severity heap buffer overflow in ImageMagick from ImageMagick. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
ImageMagick is free and open-source software used for editing and manipulating digital images. `WriteUHDRImage` in `coders/uhdr.c` uses `int` arithmetic to compute the pixel buffer size. Prior to version 7.1.2-15, when image dimensions are large, the multiplication overflows 32-bit `int`, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out of bounds heap write. Version 7.1.2-15 contains a patch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.22 | imagemagick | 7.1.2.15-r0 | ALPINE-CVE-2026-25794 |
| Alpine:v3.23 | imagemagick | 7.1.2.15-r0 | ALPINE-CVE-2026-25794 |
| Alpine:v3.24 | imagemagick | 7.1.2.15-r0 | ALPINE-CVE-2026-25794 |
| Debian:13 | imagemagick | 8:7.1.1.43+dfsg1-1+deb13u6 | DEBIAN-CVE-2026-25794 |
| Debian:13 | imagemagick | 8:7.1.1.43+dfsg1-1+deb13u6 | DSA-6158-1 |
| Debian:14 | imagemagick | 8:7.1.2.15+dfsg1-1 | DEBIAN-CVE-2026-25794 |
| NuGet | magick.net-q16-anycpu | 14.10.3 | GHSA-vhqj-f5cj-9x8h |
| NuGet | magick.net-q16-arm64 | 14.10.3 | GHSA-vhqj-f5cj-9x8h |
| NuGet | magick.net-q16-hdri-anycpu | 14.10.3 | GHSA-vhqj-f5cj-9x8h |
| NuGet | magick.net-q16-hdri-arm64 | 14.10.3 | GHSA-vhqj-f5cj-9x8h |
| NuGet | magick.net-q16-hdri-openmp-arm64 | 14.10.3 | GHSA-vhqj-f5cj-9x8h |
| NuGet | magick.net-q16-hdri-openmp-x64 | 14.10.3 | GHSA-vhqj-f5cj-9x8h |
| NuGet | magick.net-q16-hdri-x64 | 14.10.3 | GHSA-vhqj-f5cj-9x8h |
| NuGet | magick.net-q16-hdri-x86 | 14.10.3 | GHSA-vhqj-f5cj-9x8h |
| NuGet | magick.net-q16-openmp-arm64 | 14.10.3 | GHSA-vhqj-f5cj-9x8h |
| NuGet | magick.net-q16-openmp-x64 | 14.10.3 | GHSA-vhqj-f5cj-9x8h |
| NuGet | magick.net-q16-openmp-x86 | 14.10.3 | GHSA-vhqj-f5cj-9x8h |
| NuGet | magick.net-q16-x64 | 14.10.3 | GHSA-vhqj-f5cj-9x8h |
| NuGet | magick.net-q16-x86 | 14.10.3 | GHSA-vhqj-f5cj-9x8h |
| NuGet | magick.net-q8-anycpu | 14.10.3 | GHSA-vhqj-f5cj-9x8h |
| NuGet | magick.net-q8-arm64 | 14.10.3 | GHSA-vhqj-f5cj-9x8h |
| NuGet | magick.net-q8-openmp-arm64 | 14.10.3 | GHSA-vhqj-f5cj-9x8h |
| NuGet | magick.net-q8-openmp-x64 | 14.10.3 | GHSA-vhqj-f5cj-9x8h |
| NuGet | magick.net-q8-x64 | 14.10.3 | GHSA-vhqj-f5cj-9x8h |
| NuGet | magick.net-q8-x86 | 14.10.3 | GHSA-vhqj-f5cj-9x8h |
| Ubuntu:25.10 | imagemagick | 8:7.1.2.3+dfsg1-1ubuntu0.1 | UBUNTU-CVE-2026-25794 |
| Ubuntu:25.10 | imagemagick | 8:7.1.2.3+dfsg1-1ubuntu0.1 | USN-8263-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ImageMagick | ImageMagick | < 7.1.2-15 |
Weakness: CWE-122, CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
References
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vhqj-f5cj-9x8h x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-25794 vdb-entry, x_refsource_REDHAT
- RHBZ#2442110 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25794.json x_sadp-csaf-vex