CVE Intelligence
Analysis AI-assisted

CVE-2026-25897: ImageMagick sun decoder integer overflow causes heap out-of-bounds write on 32-bit builds

CVE-2026-25897 is an integer overflow in the sun decoder of ImageMagick that, on 32-bit systems or builds, can be triggered by a crafted image to cause an out-of-bounds heap write. The sources describe patches in versions 6.9.13-40 and 7.1.2-15. No confirmed exploitation appears in the sources consulted, and the CVSS base score is 9.8 in NVD but 6.5 in GitHub-sourced records.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-25897 affects the sun image decoder in ImageMagick. According to the record, an integer overflow in this decoder can lead to an out-of-bounds heap write when a crafted image is processed on 32-bit systems or builds. The weakness is classified as CWE-190 (Integer Overflow or Wraparound).

Impact

  • The record describes an out-of-bounds heap write, which can corrupt memory used by the affected process.
  • NVD scores the issue 9.8 (critical). The vector indicates network attack vector, no privileges required, no user interaction, and high confidentiality, integrity and availability impact.
  • A GitHub-sourced score in the record is 6.5.
  • SSVC data in the record rates technical impact as partial and automatability as no.

Affected products and versions

  • Product listed: Imagemagick Imagemagick.
  • The record lists versions before 6.9.13-40, and versions from 7.0.0-0 up to but not including 7.1.2-15.
  • Patched versions named in the description: 6.9.13-40 and 7.1.2-15.
  • The sources consulted do not provide a separate list of downstream packages or distributions.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted.
  • The EPSS probability is 0.0046 (percentile 0.38977) on the recorded date, and SSVC exploitation is recorded as none.

Remediation and mitigation

  • Upgrade ImageMagick to a release that contains the patch, such as 6.9.13-40 or 7.1.2-15 on the matching branch, as stated in the description.
  • Where an immediate upgrade is not possible, limit processing of untrusted image files and run image conversion in isolated, least-privileged environments.
  • Identify 32-bit ImageMagick builds and prioritize them, since the record ties the issue to those builds.

Detection guidance

  • Inventory ImageMagick installations, including their architecture and version, and check bundled copies inside applications.
  • Monitor for crashes or abnormal terminations of ImageMagick processes when they handle user-supplied images.
  • Review logs for image uploads processed by services that rely on ImageMagick.

Limitations of the available information

  • The record does not provide technical details of the trigger beyond the description, and it does not list fixed versions as structured data.
  • The NVD and GitHub-sourced CVSS scores differ (9.8 and 6.5); the record does not explain the difference.
  • Whether a given deployment is a 32-bit build is unknown from the record.

Frequently asked questions

Is CVE-2026-25897 known to be actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which ImageMagick versions contain the fix?

The description states that versions 6.9.13-40 and 7.1.2-15 contain a patch for this issue.

Why do the CVSS scores differ?

NVD lists a score of 9.8, while GitHub-sourced entries in the record list 6.5. The record does not explain the difference.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.