Junglewise Threat Intelligence

CVE-2026-25985: ImageMagick excessive memory allocation in SVG decoder

CVE-2026-25985 · Severity: high · CVSS 7.5 · Published 2026-02-24

Technologies: Red Hat Enterprise Linux, ImageMagick. Vendors: Red Hat, ImageMagick.

Executive brief

ImageMagick, a widely used tool for processing and editing digital images, is vulnerable to a denial-of-service attack. By providing a specially crafted SVG image file, an attacker can force the software to attempt to allocate an enormous amount of memory (approximately 674 GB). This typically results in the application crashing or the system becoming unresponsive, potentially disrupting services that rely on ImageMagick for automated image processing.

Technical details

A vulnerability exists in the internal SVG decoder of ImageMagick due to improper resource management (CWE-770, CWE-789). A crafted SVG file containing a malicious element can trigger an excessive memory allocation request of approximately 674 GB. This occurs because the decoder does not sufficiently limit or throttle allocation sizes based on untrusted input. The attack can be delivered over the network without authentication or user interaction, resulting in an out-of-memory (OOM) abort and denial of service. The issue is resolved in versions 7.1.2-15 and 6.9.13-40.

Affected products

  • ImageMagick ImageMagick < 6.9.13-40, >= 7.0.0 < 7.1.2-15
  • Red Hat Red Hat Enterprise Linux 6, 7 ELS

Timeline

  • 2026-02-23: advisory: GitHub Advisory GHSA-v7g2-m8c5-mf84 published
  • 2026-02-24: disclosed: CVE-2026-25985 published to NVD
  • 2026-03-24: patched: Red Hat released security updates (RHSA-2026:5573)

References