CVE-2026-25798 — ImageMagick has NULL Pointer Dereference in...
MEDIUM
ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted image
Published February 24, 2026Updated February 24, 2026Source: osv
Summary
A NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in Denial of Service.
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3704942==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x7f9d141239e0 bp 0x7ffd4c5711e0 sp 0x7ffd4c571148 T0)
#0 0x7f9d141239e0 (/lib/x86_64-linux-gnu/libc.so.6+0xc49e0)
#1 0x558a25e4f08d in ClonePixelCacheRepository._omp_fn.0 MagickCore/cache.c:784
#2 0x7f9d14c06a15 in GOMP_parallel (/lib/x86_64-linux-gnu/libgomp.so.1+0x14a15)
#3 0x558a25e43151 in ClonePixelCacheRepository MagickCore/cache.c:753
#4 0x558a25e49a96 in OpenPixelCache MagickCore/cache.c:3849
#5 0x558a25e45117 in GetImagePixelCache MagickCore/cache.c:1829
#6 0x558a25e4dde3 in SyncImagePixelCache MagickCore/cache.c:5647
#7 0x558a256ba57d in SetImageExtent MagickCore/image.c:2713
```
Advisory Timeline
- First published February 24, 2026 (230 days ago).
- Last revised February 24, 2026 — 0 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
NuGet
Update Magick.NET-Q8-x86 to 14.10.3 or laterdotnet add package Magick.NET-Q8-x86 --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-x64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-x64 --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-AnyCPU to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.10.3
NuGet
Update Magick.NET-Q16-OpenMP-x86 to 14.10.3 or laterdotnet add package Magick.NET-Q16-OpenMP-x86 --version 14.10.3
NuGet
Update Magick.NET-Q16-x86 to 14.10.3 or laterdotnet add package Magick.NET-Q16-x86 --version 14.10.3
NuGet
Update Magick.NET-Q8-OpenMP-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q8-OpenMP-arm64 --version 14.10.3
NuGet
Update Magick.NET-Q16-AnyCPU to 14.10.3 or laterdotnet add package Magick.NET-Q16-AnyCPU --version 14.10.3
NuGet
Update Magick.NET-Q8-AnyCPU to 14.10.3 or laterdotnet add package Magick.NET-Q8-AnyCPU --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-x86 to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-x86 --version 14.10.3
NuGet
Update Magick.NET-Q16-OpenMP-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-OpenMP-arm64 --version 14.10.3
NuGet
Update Magick.NET-Q16-x64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-x64 --version 14.10.3
NuGet
Update Magick.NET-Q16-OpenMP-x64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-OpenMP-x64 --version 14.10.3
NuGet
Update Magick.NET-Q16-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-arm64 --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-OpenMP-x64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-OpenMP-x64 --version 14.10.3
NuGet
Update Magick.NET-Q8-OpenMP-x64 to 14.10.3 or laterdotnet add package Magick.NET-Q8-OpenMP-x64 --version 14.10.3
NuGet
Update Magick.NET-Q8-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q8-arm64 --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-OpenMP-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.10.3
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (18)
Affects 1 ecosystem: nuget (18).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| Magick.NET-Q8-x86 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+221 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+202 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-AnyCPU | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+202 more) | 14.10.3 |
| Magick.NET-Q16-OpenMP-x86 | nuget | All versions | 14.10.3 |
| Magick.NET-Q16-x86 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+221 more) | 14.10.3 |
| Magick.NET-Q8-OpenMP-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
| Magick.NET-Q16-AnyCPU | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+205 more) | 14.10.3 |
| Magick.NET-Q8-AnyCPU | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+205 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-x86 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+202 more) | 14.10.3 |
| Magick.NET-Q16-OpenMP-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
| Magick.NET-Q16-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+221 more) | 14.10.3 |
| Magick.NET-Q16-OpenMP-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+102 more) | 14.10.3 |
| Magick.NET-Q16-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-OpenMP-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+102 more) | 14.10.3 |
| Magick.NET-Q8-OpenMP-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+102 more) | 14.10.3 |
| Magick.NET-Q8-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-OpenMP-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-476NULL Pointer DereferenceMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 5.3 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p863-5fgm-rgq4WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-25798ADVISORY
- https://github.com/ImageMagick/ImageMagick/issues/8567WEB
- https://github.com/ImageMagick/ImageMagick/commit/e046417675d5c26e5f48816851a406c121c77469WEB
- https://github.com/ImageMagick/ImageMagickPACKAGE
- https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3WEB
Frequently Asked Questions
- What is CVE-2026-25798?
- ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted image This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 5.3/10).
- How do I check if my project is affected by CVE-2026-25798?
- CVE-2026-25798 affects Magick.NET-Q8-x86, Magick.NET-Q16-HDRI-x64 and Magick.NET-Q16-HDRI-arm64 (and 15 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-25798 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
5.3
Exploitation requires specific conditions or has limited impact. Remediate within weeks.
Also Known As
GHSA-p863-5fgm-rgq4
Related CVEs
- CVE-2026-25968HIGH
ImageMagick: MSL attribute stack buffer overflow leads to out of bounds write.
- CVE-2026-25985HIGH
ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder
- CVE-2026-22770MEDIUM
ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails
- CVE-2026-25796MEDIUM
ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths
- CVE-2026-32636MEDIUM
ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash
- CVE-2026-25795MEDIUM
ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)
- CVE-2026-25797MEDIUM
ImageMagick: Code Injection via PostScript header in ps coders
- CVE-2026-56373LOW
mageMagick has a possible use-after-free write in its PDB decoder
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies