CVE Intelligence
Analysis AI-assisted

CVE-2026-25898: ImageMagick: out-of-bounds read via negative pixel index in UIL and XPM encoders

ImageMagick's UIL and XPM encoders use a pixel index returned by GetPixelIndex() as an array subscript without validating it. In HDRI builds the index can be negative, which can trigger a global out-of-bounds read during conversion. The record reports possible information disclosure or a process crash, and it lists patched versions 7.1.2-15 and 6.9.13-40.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The UIL and XPM image encoders in ImageMagick use the pixel index returned by GetPixelIndex() as an array subscript without checking its range. In HDRI builds the Quantum type is floating point, so the index can be negative. This allows an out-of-bounds read, classified in the record as CWE-125.

Impact

  • Possible disclosure of memory outside the intended buffer.
  • Possible crash of the process performing the image conversion.
  • The NVD score in the record is 9.1 (critical). The GitHub scores in the record are 6.5, so providers disagree.

Affected products and versions

  • Product in the record: Imagemagick Imagemagick.
  • Affected: before 6.9.13-40, and from 7.0.0-0 up to before 7.1.2-15.
  • The record does not list a separate fixes entry. The description states that 7.1.2-15 and 6.9.13-40 contain a patch.

Exploitation status

  • The record shows kev.listed as false. No confirmed exploitation appears in the sources consulted.
  • The EPSS probability in the record is 0.00526, with percentile 0.43767.

Remediation and mitigation

  • Upgrade to 7.1.2-15 on the newer branch, or to 6.9.13-40 on the older branch.
  • Until patching is complete, avoid converting images from untrusted sources with affected builds.
  • Run image conversion with limited privileges and in isolated environments.

Detection guidance

  • Review logs for unexpected crashes or abnormal terminations of ImageMagick processes handling UIL or XPM files.
  • Inventory ImageMagick installations, identify HDRI builds, and record their versions.

Limitations of the available information

  • The record does not include a KEV entry, a fixes list, or details of the patch.
  • The GitHub advisory is listed as a reference, but this analysis relies only on the record's metadata and description.
  • Whether a given deployment is exposed depends on its build configuration and input handling, which the record does not describe.

Frequently asked questions

What is the core weakness in CVE-2026-25898?

The encoders use a pixel index without checking its range. In HDRI builds the index can be negative, causing an out-of-bounds read classified as CWE-125.

Which versions are affected and what should be done?

The record lists versions before 6.9.13-40 and from 7.0.0-0 up to before 7.1.2-15 as affected. Upgrading to 7.1.2-15 or 6.9.13-40 is the remediation the description points to.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.