Denial of Service Vulnerability in ImageMagick by ImageMagick
CVE-2026-25989

7.5HIGH

Key Information:

Vendor

Imagemagick
Status
Imagemagick
Vendor
CVE Published:
24 February 2026

What is CVE-2026-25989?

ImageMagick, a popular open-source tool for image processing, has a vulnerable implementation that can lead to a denial of service when processing a specifically crafted SVG file. This vulnerability originates from an off-by-one boundary check error, which may allow attackers to bypass existing security measures and cause unexpected behavior during image processing. To mitigate this risk, users are encouraged to update to versions 7.1.2-15 or 6.9.13-40, which contain necessary patches to address this issue. For detailed information, please refer to the advisory.

Affected Version(s)

ImageMagick >= 7.0.0, < 7.1.2-15 < 7.0.0, 7.1.2-15

ImageMagick < 6.9.13-40 < 6.9.13-40

References

https://github.com/ImageMagick/ImageMagick/security/advis...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.