CVE-2026-25985
published 2026-02-24CVE-2026-25985: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.50%
40.0th percentile
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | imagemagick | < imagemagick 8:7.1.2.15+dfsg1-1 (forky) | imagemagick 8:7.1.2.15+dfsg1-1 (forky) |
| imagemagick | imagemagick | < 6.9.13-40 | 6.9.13-40 |
| imagemagick | imagemagick | — | — |
| imagemagick | imagemagick | >= 0 < 8:7.1.1.43+dfsg1-1+deb13u6 | 8:7.1.1.43+dfsg1-1+deb13u6 |
| imagemagick | imagemagick | >= 0 < 8:7.1.2.15+dfsg1-1 | 8:7.1.2.15+dfsg1-1 |
| imagemagick | imagemagick | >= 7.0.0-0 < 7.1.2-15 | 7.1.2-15 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder
vendor_redhat·2026-02-24·CVSS 7.5
CVE-2026-25985 [HIGH] CWE-770 ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder
ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
A memory exhaustion vulnerability has been identified in ImageMagick when processing specially crafted SVG image files. In vulnerable versions, a maliciously crafted SVG element may trigger an excessively large internal memory allocation (on the order of hundreds of gigabytes), causing the ImageMagick process to consume all available memory and abort. An application that re
Debian
CVE-2026-25985: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...
vendor_debian·2026·CVSS 7.5
CVE-2026-25985 [HIGH] CVE-2026-25985: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 8:7.1.2.15+dfsg1-1)
sid: resolved (fixed in 8:7.1.2.15+dfsg1-1)
trixie: resolved (fixed in 8:7.1.1.43+dfsg1-1+deb13u6)
OSV
CVE-2026-25985: ImageMagick is free and open-source software used for editing and manipulating digital images
osv·2026-02-24·CVSS 7.5
CVE-2026-25985 [HIGH] CVE-2026-25985: ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
OSV
ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder
osv·2026-02-24
CVE-2026-25985 [HIGH] ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder
ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder
A crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort.
Found via AFL++ fuzzing with afl-clang-lto instrumentation and AddressSanitizer.
GHSA
ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder
ghsa·2026-02-24
CVE-2026-25985 [HIGH] CWE-770 ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder
ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder
A crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort.
Found via AFL++ fuzzing with afl-clang-lto instrumentation and AddressSanitizer.
No detection rules found.
No public exploits indexed.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84https://access.redhat.com/errata/RHSA-2026:5573https://access.redhat.com/security/cve/CVE-2026-25985https://bugzilla.redhat.com/show_bug.cgi?id=2442127https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25985.json
2026-02-24
Published