CVE Intelligence
Analysis AI-assisted

CVE-2026-25968: ImageMagick MSL attribute stack buffer overflow leading to out-of-bounds write

ImageMagick is affected by a stack buffer overflow when processing an attribute in msl.c, where a long value overflows a fixed-size stack buffer and corrupts memory. The record states that versions 7.1.2-15 and 6.9.13-40 contain a patch. NVD assigns a base score of 9.8 (critical), while the GitHub scores in the record are 7.4, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

ImageMagick is open-source software for editing and manipulating digital images. According to the record, a stack buffer overflow occurs when the software processes an attribute in msl.c. A long value overflows a fixed-size stack buffer, which leads to memory corruption. The record classifies the weakness as CWE-787, Out-of-bounds Write.

Impact

Memory corruption caused by an out-of-bounds write can affect the integrity and availability of the process handling the image. NVD marks confidentiality, integrity and availability impacts as high. The exact consequences depend on the deployment and on how the application handles untrusted input, which the record does not describe.

Affected products and versions

  • Product listed as Imagemagick Imagemagick in the record.
  • Versions before 6.9.13-40.
  • Versions from 7.0.0-0 before 7.1.2-15.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The SSVC exploitation field is recorded as none, and the automatable field as yes. The EPSS probability is 0.00521 with a percentile of 0.43406.

Remediation and mitigation

  • Upgrade to a patched release: 7.1.2-15 for the 7 line or 6.9.13-40 for the 6 line.
  • Review the GitHub Security Advisory for vendor guidance.
  • Where MSL processing is not required, restrict or disable it through the application's configuration policy.
  • Limit processing of untrusted image files, especially in services that accept uploads.

Detection guidance

  • Inventory all ImageMagick installations and record their exact versions.
  • Monitor for unexpected crashes or abnormal termination of image-processing services, which may indicate memory corruption.
  • Log and review image-processing requests from untrusted sources.

Limitations of the available information

  • The structured fixes field is empty; the patched versions are taken from the description text.
  • Scores differ between providers: NVD reports 9.8 and GitHub reports 7.4.
  • The record does not describe the input needed to trigger the overflow, a proof of concept, or detailed exploitation conditions.
  • The record does not confirm whether any public exploit exists.

Frequently asked questions

Which versions are patched?

According to the record description, versions 7.1.2-15 and 6.9.13-40 contain a patch. The structured fixes field is empty, so check the GitHub advisory for confirmation.

Is this vulnerability known to be exploited?

The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.

Why do the severity scores differ?

The record shows a 9.8 score from NVD and 7.4 scores from GitHub. The record does not explain the difference, so consult each provider's assessment.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.