Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-25983: ImageMagick: Malicious Image Can Crash System or Steal Data
CVE-2026-25983 · published 7 months ago
Summary
ImageMagick, a popular image editing tool, has a security flaw that can cause a system crash or allow unauthorized access to sensitive data. This issue occurs when a specially crafted image is processed by an unpatched version of ImageMagick. Update to version 7.1.2-15 or 6.9.13-40 to fix this vulnerability.
What to do
- Update magick.net-q16-openmp-x86 to version 14.10.3.
- Update dirk lemstra magick.net-q8-anycpu to version 14.10.3.
- Update dirk lemstra magick.net-q16-hdri-anycpu to version 14.10.3.
- Update dirk lemstra magick.net-q16-anycpu to version 14.10.3.
- Update dirk lemstra magick.net-q8-x86 to version 14.10.3.
- Update dirk lemstra magick.net-q16-hdri-arm64 to version 14.10.3.
- Update dirk lemstra magick.net-q16-hdri-openmp-arm64 to version 14.10.3.
- Update dirk lemstra magick.net-q16-openmp-arm64 to version 14.10.3.
- Update dirk lemstra magick.net-q16-arm64 to version 14.10.3.
- Update dirk lemstra magick.net-q16-openmp-x64 to version 14.10.3.
- Update dirk lemstra magick.net-q8-openmp-arm64 to version 14.10.3.
- Update dirk lemstra magick.net-q16-hdri-x64 to version 14.10.3.
- Update dirk lemstra magick.net-q16-x86 to version 14.10.3.
- Update dirk lemstra magick.net-q16-hdri-x86 to version 14.10.3.
- Update dirk lemstra magick.net-q8-arm64 to version 14.10.3.
- Update dirk lemstra magick.net-q8-openmp-x64 to version 14.10.3.
- Update dirk lemstra magick.net-q16-x64 to version 14.10.3.
- Update dirk lemstra magick.net-q8-x64 to version 14.10.3.
- Update dirk lemstra magick.net-q16-hdri-openmp-x64 to version 14.10.3.
- Update debian imagemagick to version 8:7.1.1.43+dfsg1-1+deb13u6.
- Update debian imagemagick to version 8:7.1.2.15+dfsg1-1.
- Update debian rootio-imagemagick to version 8:6.9.11.60+dfsg-1.3+deb11u4.root.io.31.
- Update debian rootio-imagemagick to version 8:6.9.11.60+dfsg-1.6+deb12u5.root.io.34.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| nuget | – | magick.net-q16-openmp-x86 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q8-anycpu |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-hdri-anycpu |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-anycpu |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q8-x86 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-hdri-arm64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-hdri-openmp-arm64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-openmp-arm64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-arm64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-openmp-x64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q8-openmp-arm64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-hdri-x64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-x86 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-hdri-x86 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q8-arm64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q8-openmp-x64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-x64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q8-x64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-hdri-openmp-x64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| – | imagemagick | imagemagick |
< 6.9.13-40 >= 7.0.0-0, < 7.1.2-15 cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* |
| Debian:11 | debian | imagemagick | All versions |
| Debian:12 | debian | imagemagick | All versions |
| Debian:13 | debian | imagemagick |
< 8:7.1.1.43+dfsg1-1+deb13u6 Fix: upgrade to 8:7.1.1.43+dfsg1-1+deb13u6
|
| Debian:14 | debian | imagemagick |
< 8:7.1.2.15+dfsg1-1 Fix: upgrade to 8:7.1.2.15+dfsg1-1
|
| Root:Debian:11 | debian | rootio-imagemagick |
< 8:6.9.11.60+dfsg-1.3+deb11u4.root.io.31 Fix: upgrade to 8:6.9.11.60+dfsg-1.3+deb11u4.root.io.31
|
| Root:Debian:12 | debian | rootio-imagemagick |
< 8:6.9.11.60+dfsg-1.6+deb12u5.root.io.34 Fix: upgrade to 8:6.9.11.60+dfsg-1.6+deb12u5.root.io.34
|
Original advisory text
ImageMagick has Use After Free in MSLStartElement in "coders/msl.c"
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-25983
- https://github.com/ImageMagick/ImageMagick/commit/257200cb21de23404dce5f82618718...
- https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3
- https://github.com/advisories/GHSA-fwqw-2x5x-w566
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwqw-2x5x-w5... Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-25983 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25983... Vendor Advisory
Severity
5.3
Medium
CVSS 3.1: 9.8 (NVD)
CVSS 3.1: 9.8 (OSV)
Exploitation
EPSS <1%
Type
CWE-416Use After Free
Timeline
Published24 Feb 2026
Updated25 Sep 2026
First seen6 Mar 2026
Sources
DEBIAN-CVE-2026-25983 · OSV
CVE-2026-25983 · NVD
GHSA-fwqw-2x5x-w566 · GHSA
CVE-2026-25983 · OSV
Track software like this
Free during beta