CVE-2026-25968
published 2026-02-24CVE-2026-25968: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a stack buffer…
PriorityP356critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.27%
19.3th percentile
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | imagemagick | < imagemagick 8:6.9.11.60+dfsg-1.6+deb12u7 (bookworm) | imagemagick 8:6.9.11.60+dfsg-1.6+deb12u7 (bookworm) |
| imagemagick | imagemagick | < 6.9.13-40 | 6.9.13-40 |
| imagemagick | imagemagick | — | — |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.3+deb11u10 | 8:6.9.11.60+dfsg-1.3+deb11u10 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.6+deb12u7 | 8:6.9.11.60+dfsg-1.6+deb12u7 |
| imagemagick | imagemagick | >= 0 < 8:7.1.1.43+dfsg1-1+deb13u6 | 8:7.1.1.43+dfsg1-1+deb13u6 |
| imagemagick | imagemagick | >= 0 < 8:7.1.2.15+dfsg1-1 | 8:7.1.2.15+dfsg1-1 |
| imagemagick | imagemagick | >= 0 < 8:6.7.7.10-6ubuntu3.13+esm19 | 8:6.7.7.10-6ubuntu3.13+esm19 |
| imagemagick | imagemagick | >= 0 < 8:6.8.9.9-7ubuntu5.16+esm18 | 8:6.8.9.9-7ubuntu5.16+esm18 |
| imagemagick | imagemagick | >= 0 < 8:6.9.7.4+dfsg-16ubuntu6.15+esm10 | 8:6.9.7.4+dfsg-16ubuntu6.15+esm10 |
| imagemagick | imagemagick | >= 0 < 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm8 | 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm8 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm8 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm8 |
| imagemagick | imagemagick | >= 0 < 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm7 | 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm7 |
| imagemagick | imagemagick | >= 7.0.0-0 < 7.1.2-15 | 7.1.2-15 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian7.4HIGH
vendor_redhat7.4HIGH
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
ImageMagick up to 6.9.13-39/7.1.2-14 Image Parser msl.c stack-based overflow (GHSA-3mwp-xqp2-q6ph / Nessus ID 299945)
vuldb·2026-06-24·CVSS 9.8
CVE-2026-25968 [CRITICAL] ImageMagick up to 6.9.13-39/7.1.2-14 Image Parser msl.c stack-based overflow (GHSA-3mwp-xqp2-q6ph / Nessus ID 299945)
A vulnerability labeled as critical has been found in ImageMagick up to 6.9.13-39/7.1.2-14. This affects an unknown function of the file msl.c of the component Image Parser. Executing a manipulation can lead to stack-based buffer overflow.
This vulnerability is handled as CVE-2026-25968. The attack can be executed remotely. There is not any exploit available.
The affected component should be upgraded.
GHSA
ImageMagick: MSL attribute stack buffer overflow leads to out of bounds write.
ghsa·2026-03-12
CVE-2026-25968 [HIGH] CWE-121 ImageMagick: MSL attribute stack buffer overflow leads to out of bounds write.
ImageMagick: MSL attribute stack buffer overflow leads to out of bounds write.
A stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption.
```
==278522==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffdb8c76984 at pc 0x55a4bf16f507 bp 0x7ffdb8c75bc0 sp 0x7ffdb8c75bb0
WRITE of size 1 at 0x7ffdb8c76984 thread T0
```
OSV
ImageMagick: MSL attribute stack buffer overflow leads to out of bounds write.
osv·2026-03-12
CVE-2026-25968 [HIGH] ImageMagick: MSL attribute stack buffer overflow leads to out of bounds write.
ImageMagick: MSL attribute stack buffer overflow leads to out of bounds write.
A stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption.
```
==278522==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffdb8c76984 at pc 0x55a4bf16f507 bp 0x7ffdb8c75bc0 sp 0x7ffdb8c75bb0
WRITE of size 1 at 0x7ffdb8c76984 thread T0
```
OSV
imagemagick vulnerabilities
osv·2026-03-04·CVSS 9.8
CVE-2026-25897 [CRITICAL] imagemagick vulnerabilities
imagemagick vulnerabilities
It was discovered that ImageMagick did not properly decode certain SUN
image files. An attacker could use this issue to cause ImageMagick to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2026-25897)
It was discovered that ImageMagick did not properly validate pixel index
values when writing UIL and XPM image files. An attacker could use this issue
to cause ImageMagick to crash, resulting in a denial of service, or possibly
obtain sensitive information. (CVE-2026-25898)
It was discovered that ImageMagick's MSL decoder did not properly handle
certain attribute values. An attacker could use this issue to cause ImageMagick
to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2026-25968)
It was d
OSV
CVE-2026-25968: ImageMagick is free and open-source software used for editing and manipulating digital images
osv·2026-02-24·CVSS 9.8
CVE-2026-25968 [CRITICAL] CVE-2026-25968: ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Ubuntu
ImageMagick vulnerabilities
vendor_ubuntu·2026-03-04·CVSS 6.5
CVE-2026-25968 [MEDIUM] ImageMagick vulnerabilities
Title: ImageMagick vulnerabilities
Summary: Several security issues were fixed in ImageMagick.
It was discovered that ImageMagick did not properly decode certain SUN
image files. An attacker could use this issue to cause ImageMagick to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2026-25897)
It was discovered that ImageMagick did not properly validate pixel index
values when writing UIL and XPM image files. An attacker could use this issue
to cause ImageMagick to crash, resulting in a denial of service, or possibly
obtain sensitive information. (CVE-2026-25898)
It was discovered that ImageMagick's MSL decoder did not properly handle
certain attribute values. An attacker could use this issue to cause ImageMagick
to crash, resulting in a denial of ser
Red Hat
ImageMagick: ImageMagick: Memory corruption via stack buffer overflow when processing an attribute
vendor_redhat·2026-02-24·CVSS 7.4
CVE-2026-25968 [HIGH] CWE-120 ImageMagick: ImageMagick: Memory corruption via stack buffer overflow when processing an attribute
ImageMagick: ImageMagick: Memory corruption via stack buffer overflow when processing an attribute
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
A flaw was found in ImageMagick. A remote attacker could exploit a stack buffer overflow vulnerability by providing a specially crafted image file with a long attribute value. This flaw occurs when processing an attribute in msl.c, leading to memory corruption. This can result in unpredictable behavior or a denial of service.
Statement: A MODERATE impact s
Debian
CVE-2026-25968: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...
vendor_debian·2026·CVSS 7.4
CVE-2026-25968 [HIGH] CVE-2026-25968: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Scope: local
bookworm: resolved (fixed in 8:6.9.11.60+dfsg-1.6+deb12u7)
bullseye: resolved (fixed in 8:6.9.11.60+dfsg-1.3+deb11u10)
forky: resolved (fixed in 8:7.1.2.15+dfsg1-1)
sid: resolved (fixed in 8:7.1.2.15+dfsg1-1)
trixie: resolved (fixed in 8:7.1.1.43+dfsg1-1+deb13u6)
No detection rules found.
No public exploits indexed.
Qualys
Oracle Critical Patch Update, April 2026 Security Update Review
blogs_qualys·2026-04-22
CVE-2025-6965 Oracle Critical Patch Update, April 2026 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Oracle released its second quarterly edition of this year’s Critical Patch Update. The update received patches for 481 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 139, constituting about 28% of the total patches released. Oracle Financial Services Applications and Oracle Fusion Middleware followed, with 75 and 59 security patches.
376 of the 481 security patches provided by the April Critical Patch Update (about 78%)
Wiz
CVE-2026-25968 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.4
CVE-2026-25968 [HIGH] CVE-2026-25968 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-25968 :
C# vulnerability analysis and mitigation
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Source : NVD
## 9.8
Score
Published February 24, 2026
Severity CRITICAL
CNA Score 7.4
Affected Technologies
C#
ImageMagick
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 19.1
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
ImageMagick-perl-debuginfo
Magick.NET-Q8-arm
2026-02-24
Published