CVE-2026-25794
HIGH
ImageMagick has heap-buffer-overflow via signed integer overflow in WriteUHDRImage when writing UHDR images with large dimensions
Published February 24, 2026Updated April 8, 2026Source: osv
Summary
`WriteUHDRImage` in `coders/uhdr.c` uses `int` arithmetic to compute the pixel buffer size. When image dimensions are large, the multiplication overflows 32-bit `int`, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out of bounds heap write.
```
==1575126==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fc382ef3820 at pc 0x5560d31f229f bp 0x7ffe865f9530 sp 0x7ffe865f9520
WRITE of size 8 at 0x7fc382ef3820 thread T0
#0 0x5560d31f229e in WriteUHDRImage coders/uhdr.c:807
```
Remediation
Upgrade to the fixed version using your package manager.
NuGet
Update Magick.NET-Q8-x86 to 14.10.3 or laterdotnet add package Magick.NET-Q8-x86 --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-x64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-x64 --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-AnyCPU to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.10.3
NuGet
Update Magick.NET-Q16-OpenMP-x86 to 14.10.3 or laterdotnet add package Magick.NET-Q16-OpenMP-x86 --version 14.10.3
NuGet
Update Magick.NET-Q16-x86 to 14.10.3 or laterdotnet add package Magick.NET-Q16-x86 --version 14.10.3
NuGet
Update Magick.NET-Q8-OpenMP-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q8-OpenMP-arm64 --version 14.10.3
NuGet
Update Magick.NET-Q16-AnyCPU to 14.10.3 or laterdotnet add package Magick.NET-Q16-AnyCPU --version 14.10.3
NuGet
Update Magick.NET-Q8-AnyCPU to 14.10.3 or laterdotnet add package Magick.NET-Q8-AnyCPU --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-x86 to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-x86 --version 14.10.3
NuGet
Update Magick.NET-Q16-OpenMP-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-OpenMP-arm64 --version 14.10.3
NuGet
Update Magick.NET-Q16-x64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-x64 --version 14.10.3
NuGet
Update Magick.NET-Q16-OpenMP-x64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-OpenMP-x64 --version 14.10.3
NuGet
Update Magick.NET-Q16-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-arm64 --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-OpenMP-x64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-OpenMP-x64 --version 14.10.3
NuGet
Update Magick.NET-Q8-OpenMP-x64 to 14.10.3 or laterdotnet add package Magick.NET-Q8-OpenMP-x64 --version 14.10.3
NuGet
Update Magick.NET-Q8-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q8-arm64 --version 14.10.3
NuGet
Update Magick.NET-Q8-x64 to 14.10.3 or laterdotnet add package Magick.NET-Q8-x64 --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-OpenMP-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.10.3
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (19)
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| Magick.NET-Q8-x86 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+221 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+202 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-AnyCPU | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+202 more) | 14.10.3 |
| Magick.NET-Q16-OpenMP-x86 | nuget | All versions | 14.10.3 |
| Magick.NET-Q16-x86 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+221 more) | 14.10.3 |
| Magick.NET-Q8-OpenMP-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
| Magick.NET-Q16-AnyCPU | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+205 more) | 14.10.3 |
| Magick.NET-Q8-AnyCPU | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+205 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-x86 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+202 more) | 14.10.3 |
| Magick.NET-Q16-OpenMP-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
| Magick.NET-Q16-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+221 more) | 14.10.3 |
| Magick.NET-Q16-OpenMP-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+102 more) | 14.10.3 |
| Magick.NET-Q16-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-OpenMP-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+102 more) | 14.10.3 |
| Magick.NET-Q8-OpenMP-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+102 more) | 14.10.3 |
| Magick.NET-Q8-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
| Magick.NET-Q8-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+221 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-OpenMP-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-122
- CWE-190Integer OverflowMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 8.2 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
References
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vhqj-f5cj-9x8hWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-25794ADVISORY
- https://github.com/ImageMagick/ImageMagick/commit/ffe589df5ff8ce1433daa4ccb0d2a9fadfbe30edWEB
- https://github.com/ImageMagick/ImageMagickPACKAGE
- https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3WEB
Frequently Asked Questions
- What is CVE-2026-25794?
- ImageMagick has heap-buffer-overflow via signed integer overflow in WriteUHDRImage when writing UHDR images with large dimensions This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.2/10).
- How do I check if my project is affected by CVE-2026-25794?
- CVE-2026-25794 affects Magick.NET-Q8-x86, Magick.NET-Q16-HDRI-x64 and Magick.NET-Q16-HDRI-arm64 (and 16 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-25794 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
8.2
High exploitability or significant impact. Prioritize remediation within days.
Also Known As
GHSA-vhqj-f5cj-9x8h
Related CVEs
- CVE-2026-25968HIGH
ImageMagick: MSL attribute stack buffer overflow leads to out of bounds write.
- CVE-2026-22770MEDIUM
ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails
- CVE-2026-28690MEDIUM
ImageMagick has stack write buffer overflow in MNG encoder
- CVE-2026-25796MEDIUM
ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths
- CVE-2026-25795MEDIUM
ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)
- CVE-2026-25798MEDIUM
ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted image
- CVE-2026-25797MEDIUM
ImageMagick: Code Injection via PostScript header in ps coders
- CVE-2026-56373LOW
mageMagick has a possible use-after-free write in its PDB decoder
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies