CVE-2026-25797 — Vulnerability in Magick.NET-Q8-x86 — CVE Details
MEDIUM
ImageMagick: Code Injection via PostScript header in ps coders
Published February 24, 2026Updated February 24, 2026Source: osv
Summary
The ps encoders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript header. An attacker can provide a malicious file and inject arbitrary PostScript code. When the resulting file is processed by a printer or a viewer (like Ghostscript), the injected code is interpreted and executed.
The html encoder does not properly escape strings that are written to in the html document. An attacker can provide a malicious file and injection arbitrary html code.
Advisory Timeline
- First published February 24, 2026 (230 days ago).
- Last revised February 24, 2026 — 0 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
NuGet
Update Magick.NET-Q8-x86 to 14.10.3 or laterdotnet add package Magick.NET-Q8-x86 --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-x64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-x64 --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-AnyCPU to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.10.3
NuGet
Update Magick.NET-Q16-OpenMP-x86 to 14.10.3 or laterdotnet add package Magick.NET-Q16-OpenMP-x86 --version 14.10.3
NuGet
Update Magick.NET-Q16-x86 to 14.10.3 or laterdotnet add package Magick.NET-Q16-x86 --version 14.10.3
NuGet
Update Magick.NET-Q8-OpenMP-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q8-OpenMP-arm64 --version 14.10.3
NuGet
Update Magick.NET-Q16-AnyCPU to 14.10.3 or laterdotnet add package Magick.NET-Q16-AnyCPU --version 14.10.3
NuGet
Update Magick.NET-Q8-AnyCPU to 14.10.3 or laterdotnet add package Magick.NET-Q8-AnyCPU --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-x86 to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-x86 --version 14.10.3
NuGet
Update Magick.NET-Q16-OpenMP-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-OpenMP-arm64 --version 14.10.3
NuGet
Update Magick.NET-Q16-OpenMP-x64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-OpenMP-x64 --version 14.10.3
NuGet
Update Magick.NET-Q16-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-arm64 --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-OpenMP-x64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-OpenMP-x64 --version 14.10.3
NuGet
Update Magick.NET-Q8-OpenMP-x64 to 14.10.3 or laterdotnet add package Magick.NET-Q8-OpenMP-x64 --version 14.10.3
NuGet
Update Magick.NET-Q8-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q8-arm64 --version 14.10.3
NuGet
Update Magick.NET-Q8-x64 to 14.10.3 or laterdotnet add package Magick.NET-Q8-x64 --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-OpenMP-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.10.3
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (18)
Affects 1 ecosystem: nuget (18).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| Magick.NET-Q8-x86 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+221 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+202 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-AnyCPU | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+202 more) | 14.10.3 |
| Magick.NET-Q16-OpenMP-x86 | nuget | All versions | 14.10.3 |
| Magick.NET-Q16-x86 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+221 more) | 14.10.3 |
| Magick.NET-Q8-OpenMP-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
| Magick.NET-Q16-AnyCPU | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+205 more) | 14.10.3 |
| Magick.NET-Q8-AnyCPU | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+205 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-x86 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+202 more) | 14.10.3 |
| Magick.NET-Q16-OpenMP-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
| Magick.NET-Q16-OpenMP-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+102 more) | 14.10.3 |
| Magick.NET-Q16-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-OpenMP-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+102 more) | 14.10.3 |
| Magick.NET-Q8-OpenMP-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+102 more) | 14.10.3 |
| Magick.NET-Q8-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
| Magick.NET-Q8-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+221 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-OpenMP-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-94Code InjectionMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 5.7 score means for each attack dimension.
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
Low
Availability
Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
References
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rw6c-xp26-225vWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-25797ADVISORY
- https://github.com/ImageMagick/ImageMagick/commit/26088a83d71e9daa203d54a56fe3c31f3f85463dWEB
- https://github.com/ImageMagick/ImageMagickPACKAGE
- https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3WEB
Frequently Asked Questions
- What is CVE-2026-25797?
- ImageMagick: Code Injection via PostScript header in ps coders This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 5.7/10).
- How do I check if my project is affected by CVE-2026-25797?
- CVE-2026-25797 affects Magick.NET-Q8-x86, Magick.NET-Q16-HDRI-x64 and Magick.NET-Q16-HDRI-arm64 (and 15 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-25797 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
5.7
Exploitation requires specific conditions or has limited impact. Remediate within weeks.
Also Known As
GHSA-rw6c-xp26-225v
Related CVEs
- CVE-2026-30929HIGH
ImageMagick has stack buffer overflow in MagnifyImage
- CVE-2026-22770MEDIUM
ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails
- CVE-2026-28690MEDIUM
ImageMagick has stack write buffer overflow in MNG encoder
- CVE-2026-25983MEDIUM
ImageMagick has Use After Free in MSLStartElement in "coders/msl.c"
- CVE-2026-25796MEDIUM
ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths
- CVE-2026-33535MEDIUM
ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interaction
- CVE-2026-25795MEDIUM
ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)
- CVE-2026-56373LOW
mageMagick has a possible use-after-free write in its PDB decoder
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies