CVE-2026-25795: ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in ReadSFWImage() (coders/sfw.c), when temporary file creation fails, readinfo is destroyed before its filename member is accessed, causing a NULL pointer dereference and crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Other sources
In ReadSFWImage() (coders/sfw.c), when temporary file creation fails, readinfo is destroyed before its filename member is accessed, causing a NULL pointer dereference and crash.
AddressSanitizer:DEADLYSIGNAL ================================================================= ==1414421==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x56260222912f bp 0x7ffec0a193b0 sp 0x7ffec0a19360 T0) #0 0x56260222912f (/data/ylwang/LargeScan/targets/ImageMagick/utilities/magick+0x235f12f)
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25795?
CVE-2026-25795 has been classified as having a moderate severity level due to its potential to cause application crashes.
How do I fix CVE-2026-25795?
To fix CVE-2026-25795, update ImageMagick to version 7.1.2-15 or 6.9.13-40 or later.
What software is affected by CVE-2026-25795?
CVE-2026-25795 affects ImageMagick versions prior to 7.1.2-15 and 6.9.13-40.
What type of vulnerability is CVE-2026-25795?
CVE-2026-25795 is characterized as a NULL pointer dereference vulnerability leading to crashes in ImageMagick.
Can CVE-2026-25795 be exploited remotely?
CVE-2026-25795 can potentially be exploited remotely if an attacker manipulates image files processed by the vulnerable ImageMagick versions.