CVE-2026-25969 — Image Magick has a Memory Leak in...
MEDIUM
Image Magick has a Memory Leak in coders/ashlar.c
Published February 24, 2026Updated September 10, 2026Source: osv
Summary
Memory leak exists in `coders/ashlar.c`. The `WriteASHLARImage` allocates a structure. However, when an exception is thrown, the allocated memory is not properly released, resulting in a potential memory leak.
```
```bash
==78968== Memcheck, a memory error detector
==78968== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==78968== Using Valgrind-3.22.0 and LibVEX; rerun with -h for copyright info
==78968==
==78968== HEAP SUMMARY:
==78968== in use at exit: 17,232 bytes in 4 blocks
==78968== total heap usage: 4,781 allocs, 4,777 frees, 785,472 bytes allocated
```
Advisory Timeline
- First published February 24, 2026 (230 days ago).
- Last revised September 10, 2026 — 198 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
NuGet
Update Magick.NET-Q8-x86 to 14.10.3 or laterdotnet add package Magick.NET-Q8-x86 --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-x64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-x64 --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-AnyCPU to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.10.3
NuGet
Update Magick.NET-Q16-OpenMP-x86 to 14.10.3 or laterdotnet add package Magick.NET-Q16-OpenMP-x86 --version 14.10.3
NuGet
Update Magick.NET-Q16-x86 to 14.10.3 or laterdotnet add package Magick.NET-Q16-x86 --version 14.10.3
NuGet
Update Magick.NET-Q8-OpenMP-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q8-OpenMP-arm64 --version 14.10.3
NuGet
Update Magick.NET-Q16-AnyCPU to 14.10.3 or laterdotnet add package Magick.NET-Q16-AnyCPU --version 14.10.3
NuGet
Update Magick.NET-Q8-AnyCPU to 14.10.3 or laterdotnet add package Magick.NET-Q8-AnyCPU --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-x86 to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-x86 --version 14.10.3
NuGet
Update Magick.NET-Q16-OpenMP-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-OpenMP-arm64 --version 14.10.3
NuGet
Update Magick.NET-Q16-OpenMP-x64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-OpenMP-x64 --version 14.10.3
NuGet
Update Magick.NET-Q16-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-arm64 --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-OpenMP-x64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-OpenMP-x64 --version 14.10.3
NuGet
Update Magick.NET-Q8-OpenMP-x64 to 14.10.3 or laterdotnet add package Magick.NET-Q8-OpenMP-x64 --version 14.10.3
NuGet
Update Magick.NET-Q8-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q8-arm64 --version 14.10.3
NuGet
Update Magick.NET-Q8-x64 to 14.10.3 or laterdotnet add package Magick.NET-Q8-x64 --version 14.10.3
NuGet
Update Magick.NET-Q16-HDRI-OpenMP-arm64 to 14.10.3 or laterdotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.10.3
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (18)
Affects 1 ecosystem: nuget (18).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| Magick.NET-Q8-x86 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+221 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+202 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-AnyCPU | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+202 more) | 14.10.3 |
| Magick.NET-Q16-OpenMP-x86 | nuget | All versions | 14.10.3 |
| Magick.NET-Q16-x86 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+221 more) | 14.10.3 |
| Magick.NET-Q8-OpenMP-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
| Magick.NET-Q16-AnyCPU | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+205 more) | 14.10.3 |
| Magick.NET-Q8-AnyCPU | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+205 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-x86 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+202 more) | 14.10.3 |
| Magick.NET-Q16-OpenMP-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
| Magick.NET-Q16-OpenMP-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+102 more) | 14.10.3 |
| Magick.NET-Q16-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-OpenMP-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+102 more) | 14.10.3 |
| Magick.NET-Q8-OpenMP-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+102 more) | 14.10.3 |
| Magick.NET-Q8-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
| Magick.NET-Q8-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+221 more) | 14.10.3 |
| Magick.NET-Q16-HDRI-OpenMP-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+50 more) | 14.10.3 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-401Memory LeakMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 5.3 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xgm3-v4r9-wfgmWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-25969ADVISORY
- https://github.com/ImageMagick/ImageMagick/commit/a253d1b124ebdcc2832daac6f9a35c362635b40eWEB
- https://github.com/ImageMagick/ImageMagickPACKAGE
- https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3WEB
Frequently Asked Questions
- What is CVE-2026-25969?
- Image Magick has a Memory Leak in coders/ashlar.c This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 5.3/10).
- How do I check if my project is affected by CVE-2026-25969?
- CVE-2026-25969 affects Magick.NET-Q8-x86, Magick.NET-Q16-HDRI-x64 and Magick.NET-Q16-HDRI-arm64 (and 15 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-25969 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
5.3
Exploitation requires specific conditions or has limited impact. Remediate within weeks.
Also Known As
GHSA-xgm3-v4r9-wfgm
Related CVEs
- CVE-2026-25988MEDIUM
ImageMagick: MSL image stack index may fail to refresh, leading to leaked images
- CVE-2026-28687MEDIUM
ImageMagick has Heap Use-After-Free in ImageMagick MSL decoder
- CVE-2026-25983MEDIUM
ImageMagick has Use After Free in MSLStartElement in "coders/msl.c"
- CVE-2026-25986MEDIUM
ImageMagick has heap buffer overflow in YUV 4:2:2 decoder
- CVE-2026-28692MEDIUM
ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder
- CVE-2026-33535MEDIUM
ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interaction
- CVE-2026-27799MEDIUM
ImageMagick has a heap Buffer Over-read in its DJVU image format handler
- CVE-2026-56376LOW
ImageMagick has a possible heap Use After Free vulnerability in its meta coder
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies