Executive brief
ImageMagick is a widely used software suite for creating, editing, and converting images. A vulnerability in its HTML encoding component could allow an attacker to inject malicious code when processing certain files. This could lead to unauthorized modifications or impact the reliability of services that use this library to generate web-based image previews or reports.
Technical details
A code injection vulnerability exists in the ImageMagick HTML encoder due to an incomplete fix for CVE-2026-25797. The flaw is rooted in improper neutralization of input during web page generation (CWE-79) and improper encoding or escaping of output (CWE-116). An attacker with local access can exploit this to inject code into the HTML output generated by the library. While the attack vector is local, the scope is considered changed (S:C) because the vulnerability impacts the integrity of the generated HTML content. The issue is addressed in Magick.NET version 14.10.3.
Affected products
- ImageMagick Magick.NET-Q16-AnyCPU < 14.10.3
- ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.10.3
- ImageMagick Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.10.3
- ImageMagick Magick.NET-Q16-HDRI-arm64 < 14.10.3
- ImageMagick Magick.NET-Q16-HDRI-x64 < 14.10.3
- ImageMagick Magick.NET-Q16-HDRI-x86 < 14.10.3
- ImageMagick Magick.NET-Q16-OpenMP-arm64 < 14.10.3
- ImageMagick Magick.NET-Q16-OpenMP-x64 < 14.10.3
- ImageMagick Magick.NET-Q16-arm64 < 14.10.3
- ImageMagick Magick.NET-Q16-x64 < 14.10.3
- ImageMagick Magick.NET-Q16-x86 < 14.10.3
- ImageMagick Magick.NET-Q8-AnyCPU < 14.10.3
- ImageMagick, Magick.NET-Q8-OpenMP-arm64 < 14.10.3
- ImageMagick Magick.NET-Q8-OpenMP-x64 < 14.10.3
- ImageMagick Magick.NET-Q8-arm64 < 14.10.3
- ImageMagick Magick.NET-Q8-x64 < 14.10.3
- ImageMagick Magick.NET-Q8-x86 < 14.10.3
Timeline
- 2026-06-26: disclosed: Initial disclosure in ImageMagick repository
- 2026-06-26: patched: Magick.NET version 14.10.3 released
- 2026-07-24: advisory: GitHub Advisory published