ImageMagick has heap-buffer-overflow via signed integer overflow in `WriteUHDRImage` when writing UHDR images with large dimensions

published 2026-02-24 8 mo ago modified 2026-09-10 1 mo ago also EUVD-2026-7448 , GHSA-vhqj-f5cj-9x8h , JLSEC-2026-944

cvss: 8.2; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits: 0; none known

ImageMagick is free and open-source software used for editing and manipulating digital images. `WriteUHDRImage` in `coders/uhdr.c` uses `int` arithmetic to compute the pixel buffer size. Prior to version 7.1.2-15, when image dimensions are large, the multiplication overflows 32-bit `int`, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out of bounds heap write. Version 7.1.2-15 contains a patch.

Patch / fix

fixed in 21 distros 4 links 2

nuget Magick.NET-Q16-AnyCPU 14.10.3
nuget Magick.NET-Q16-HDRI-AnyCPU 14.10.3
nuget Magick.NET-Q16-HDRI-OpenMP-arm64 14.10.3
nuget Magick.NET-Q16-HDRI-OpenMP-x64 14.10.3
nuget Magick.NET-Q16-HDRI-arm64 14.10.3
nuget Magick.NET-Q16-HDRI-x64 14.10.3
nuget Magick.NET-Q16-HDRI-x86 14.10.3
nuget Magick.NET-Q16-OpenMP-arm64 14.10.3
nuget Magick.NET-Q16-OpenMP-x64 14.10.3
nuget Magick.NET-Q16-OpenMP-x86 14.10.3
nuget Magick.NET-Q16-arm64 14.10.3
nuget Magick.NET-Q16-x64 14.10.3
nuget Magick.NET-Q16-x86 14.10.3
nuget Magick.NET-Q8-AnyCPU 14.10.3
nuget Magick.NET-Q8-OpenMP-arm64 14.10.3
nuget Magick.NET-Q8-OpenMP-x64 14.10.3
nuget Magick.NET-Q8-arm64 14.10.3
nuget Magick.NET-Q8-x64 14.10.3
nuget Magick.NET-Q8-x86 14.10.3
julia ImageMagick_jll 7.1.2023+0
imagemagick imagemagick 7.1.2-15

debian ubuntu opensuse alpine

imagemagick Debian 13 8:7.1.1.43+dfsg1-1+deb13u6
imagemagick Debian 14 8:7.1.2.15+dfsg1-1

debian advisories DEBIAN-CVE-2026-25794

imagemagick Ubuntu 25.10 8:7.1.2.3+dfsg1-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2026-25794

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

ImageMagick openSUSE Leap 16.0 7.1.2.0-160000.6.1
ImageMagick openSUSE Tumbleweed 7.1.2.15-1.1

opensuse advisories openSUSE-SU-2026:20337-1 openSUSE-SU-2026:10267-1

imagemagick Alpine 3.24, Alpine 3.23, Alpine 3.22 7.1.2.15-r0

alpine advisories ALPINE-CVE-2026-25794

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-25794 updated 2026-11-04 cvss 8.2

ImageMagick: ImageMagick: Denial of service and potential arbitrary code execution via integer overflow in image processing

Red Hat Enterprise Linux 6 ImageMagick, ImageMagick-c++, ImageMagick-perl
affected: workaround, no fix planned “Out of support scope”
Red Hat Enterprise Linux 7 ImageMagick, ImageMagick-c++, ImageMagick-perl
not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 8 mo ago (2026-02-26)

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CISA ADP	3.1	8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
GitHub	3.1	8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
OSV	3.1	8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
nuget	Magick.NET-Q16-AnyCPU	<14.10.3	14.10.3
nuget	Magick.NET-Q16-HDRI-AnyCPU	<14.10.3	14.10.3
nuget	Magick.NET-Q16-HDRI-OpenMP-arm64	<14.10.3	14.10.3
nuget	Magick.NET-Q16-HDRI-OpenMP-x64	<14.10.3	14.10.3
nuget	Magick.NET-Q16-HDRI-arm64	<14.10.3	14.10.3
nuget	Magick.NET-Q16-HDRI-x64	<14.10.3	14.10.3
nuget	Magick.NET-Q16-HDRI-x86	<14.10.3	14.10.3
nuget	Magick.NET-Q16-OpenMP-arm64	<14.10.3	14.10.3
nuget	Magick.NET-Q16-OpenMP-x64	<14.10.3	14.10.3
nuget	Magick.NET-Q16-OpenMP-x86	<14.10.3	14.10.3
nuget	Magick.NET-Q16-arm64	<14.10.3	14.10.3
nuget	Magick.NET-Q16-x64	<14.10.3	14.10.3
nuget	Magick.NET-Q16-x86	<14.10.3	14.10.3
nuget	Magick.NET-Q8-AnyCPU	<14.10.3	14.10.3
nuget	Magick.NET-Q8-OpenMP-arm64	<14.10.3	14.10.3
nuget	Magick.NET-Q8-OpenMP-x64	<14.10.3	14.10.3
nuget	Magick.NET-Q8-arm64	<14.10.3	14.10.3
nuget	Magick.NET-Q8-x64	<14.10.3	14.10.3
nuget	Magick.NET-Q8-x86	<14.10.3	14.10.3
julia	ImageMagick_jll	<7.1.2023+0	7.1.2023+0

Affected products

ImageMagick ImageMagick
Red Hat Red Hat Enterprise Linux 6
Red Hat Red Hat Enterprise Linux 7

Classification

Weakness

CWE-122 Heap-based Buffer Overflow
CWE-190 Integer Overflow or Wraparound

References

github.com /ImageMagick/ImageMagick/commit/ffe589df5ff8ce1433daa4ccb0d2a9fadfbe30ed
web
github.com /ImageMagick/ImageMagick/security/advisories/GHSA-vhqj-f5cj-9x8h
web, vendor-advisory
access.redhat.com /security/cve/CVE-2026-25794
vdb-entry, web
bugzilla.redhat.com /show_bug.cgi?id=2442110
issue-tracking, web
security.access.redhat.com /data/csaf/v2/vex/2026/cve-2026-25794.json
web
nvd.nist.gov /vuln/detail/CVE-2026-25794
advisory, web
github.com /ImageMagick/ImageMagick
package
github.com /dlemstra/Magick.NET/releases/tag/14.10.3
web
github.com /advisories/GHSA-vhqj-f5cj-9x8h
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary