CVE Intelligence
Analysis AI-assisted

CVE-2026-25971: ImageMagick MSL: stack overflow from circular script references

ImageMagick versions before 7.1.2-15 and 6.9.13-40 do not check for circular references between two MSL scripts, which can cause a stack overflow. NVD rates the issue critical with a 9.8 CVSS score, while GitHub rates it 6.2. The record states that 7.1.2-15 and 6.9.13-40 contain a patch, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

ImageMagick is open-source software for editing and manipulating digital images. According to the record, it does not check for circular references between two MSL scripts, which leads to a stack overflow. The CWE listed for this record is CWE-787, Out-of-bounds Write.

Impact

  • NVD assigns a CVSS base score of 9.8 (critical). The NVD scoring describes a network attack vector, no privileges required, no user interaction, and high confidentiality, integrity and availability impact.
  • GitHub assigns a score of 6.2 in its own records.
  • The exact consequences in a given deployment depend on how the application processes untrusted MSL input, which the record does not describe.

Affected products and versions

  • ImageMagick before 6.9.13-40.
  • ImageMagick from 7.0.0-0 up to before 7.1.2-15.
  • The record says that 7.1.2-15 and 6.9.13-40 contain a patch.

Exploitation status

The CVE is not listed in CISA KEV. No confirmed exploitation appears in the sources consulted. SSVC marks exploitation as none and automatable as no. The EPSS probability is 0.00415 with a percentile of 0.3474.

Remediation and mitigation

  • Upgrade to 7.1.2-15 or 6.9.13-40, or a later release of the respective branch.
  • Until patching is complete, limit processing of untrusted MSL or other script-based image inputs.
  • Run image-processing services with restricted privileges and in isolated environments where possible.

Detection guidance

  • Inventory all ImageMagick installations and record their exact versions.
  • Review logs and monitoring for crashes or abnormal termination in processes that handle MSL input.
  • Track vendor advisories for updates to the scoring and affected-version information.

Limitations of the available information

  • The record's fixed-version field is empty, although the description states that patched versions exist.
  • NVD and GitHub scores differ (9.8 and 6.2), and the record does not explain the difference.
  • The description says stack overflow while the CWE is out-of-bounds write.
  • Technical details of the trigger conditions are not included in the record, and this analysis does not provide them.
  • The EPSS date in the record is 2026-10-23, which is later than the publication date, so the value should be checked against the current feed.

Frequently asked questions

Is this vulnerability being actively exploited?

It is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Which versions contain a fix?

The record states that 7.1.2-15 and 6.9.13-40 contain a patch. Upgrading to those versions or a later release of the same branch is recommended.

Why do the severity scores differ?

NVD gives a 9.8 CVSS score and GitHub gives 6.2. The record does not explain the difference, so organizations should review both sources.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.