CVE-2026-25985
published 2026-02-24CVE-2026-25985: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.56%
46.2th percentile
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | imagemagick | < imagemagick 8:7.1.2.15+dfsg1-1 (forky) | imagemagick 8:7.1.2.15+dfsg1-1 (forky) |
| imagemagick | imagemagick | < 6.9.13-40 | 6.9.13-40 |
| imagemagick | imagemagick | — | — |
| imagemagick | imagemagick | >= 0 < 8:7.1.1.43+dfsg1-1+deb13u6 | 8:7.1.1.43+dfsg1-1+deb13u6 |
| imagemagick | imagemagick | >= 0 < 8:7.1.2.15+dfsg1-1 | 8:7.1.2.15+dfsg1-1 |
| imagemagick | imagemagick | >= 7.0.0-0 < 7.1.2-15 | 7.1.2-15 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder
vendor_redhat·2026-02-24·CVSS 7.5
CVE-2026-25985 [HIGH] CWE-770 ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder
ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
A memory exhaustion vulnerability has been identified in ImageMagick when processing specially crafted SVG image files. In vulnerable versions, a maliciously crafted SVG element may trigger an excessively large internal memory allocation (on the order of hundreds of gigabytes), causing the ImageMagick process to consume all available memory and abort. An application that re
Debian
CVE-2026-25985: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...
vendor_debian·2026·CVSS 7.5
CVE-2026-25985 [HIGH] CVE-2026-25985: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 8:7.1.2.15+dfsg1-1)
sid: resolved (fixed in 8:7.1.2.15+dfsg1-1)
trixie: resolved (fixed in 8:7.1.1.43+dfsg1-1+deb13u6)
OSV
CVE-2026-25985: ImageMagick is free and open-source software used for editing and manipulating digital images
osv·2026-02-24·CVSS 7.5
CVE-2026-25985 [HIGH] CVE-2026-25985: ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
OSV
ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder
osv·2026-02-24
CVE-2026-25985 [HIGH] ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder
ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder
A crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort.
Found via AFL++ fuzzing with afl-clang-lto instrumentation and AddressSanitizer.
GHSA
ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder
ghsa·2026-02-24
CVE-2026-25985 [HIGH] CWE-770 ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder
ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder
A crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort.
Found via AFL++ fuzzing with afl-clang-lto instrumentation and AddressSanitizer.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-25985 ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder [fedora-all]
bugzilla·2026-02-24·CVSS 7.5
CVE-2026-25985 [HIGH] CVE-2026-25985 ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder [fedora-all]
CVE-2026-25985 ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.
Wiz
CVE-2026-25985 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-25985 [HIGH] CVE-2026-25985 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-25985 :
C# vulnerability analysis and mitigation
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Source : NVD
## 7.5
Score
Published February 24, 2026
Severity HIGH
CNA Score 7.5
Affected Technologies
C#
ImageMagick
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 4.8
Exploitation Probability (EPSS) N/A
Affected packages and libraries
Magick.NET-Q16-OpenMP-x64
Magick.NET-Q16-OpenMP-x86
Sou
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84https://access.redhat.com/errata/RHSA-2026:5573https://access.redhat.com/security/cve/CVE-2026-25985https://bugzilla.redhat.com/show_bug.cgi?id=2442127https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25985.json
2026-02-24
Published