CVE-2026-25898 Details
Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the UIL and XPM image encoder do not validate the pixel index value returned by `GetPixelIndex()` before using it as an array subscript. In HDRI builds, `Quantum` is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
A global buffer overflow vulnerability allowing out-of-bounds read has been identified in the UIL and XPM image encoders of ImageMagick. This issue affects versions prior to 7.1.2-15 and 6.9.13-40. The vulnerability arises because the encoders do not properly validate pixel index values returned by 'GetPixelIndex()' before using them as array subscripts. In HDRI builds, the 'Quantum' type is floating-point, which can result in negative pixel index values. An attacker could exploit this by crafting an image with such negative values, triggering the buffer overflow during image conversion. This exploitation could lead to information disclosure or cause a crash of the processing application.
Users can upgrade to ImageMagick versions 7.1.2-15 or 6.9.13-40, both of which include the necessary patch to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vpxv-r9pg-7gpr | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| imagemagick imagemagick | < 6.9.13-40 >= 7.0.0-0, < 7.1.2-15 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 25, 2026 | Initial Analysis | [email protected] |
| Feb 24, 2026 | New CVE Received | [email protected] |