CVE-2026-25796: ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths
Summary
In ReadSTEGANOImage() (coders/stegano.c), the watermark Image object is not freed on three early-return paths, resulting in a definite memory leak (~13.5KB+ per invocation) that can be exploited for denial of service.
Direct leak of 13512 byte(s) in 1 object(s) allocated from: #0 0x7f5c11e27887 in interceptormalloc ../../../../src/libsanitizer/asan/asanmalloclinux.cpp:145 #1 0x55cdc38f65c4 in AcquireMagickMemory MagickCore/memory.c:536 #2 0x55cdc38f65eb in AcquireCriticalMemory MagickCore/memory.c:612 #3 0x55cdc3899e91 in AcquireImage MagickCore/image.c:154
Other sources
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in ReadSTEGANOImage() (coders/stegano.c), the watermark Image object is not freed on three early-return paths, resulting in a definite memory leak (~13.5KB+ per invocation) that can be exploited for denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25796?
CVE-2026-25796 has been classified with a severity that highlights potential memory leaks in the ImageMagick library.
How do I fix CVE-2026-25796?
To fix CVE-2026-25796, upgrade to ImageMagick version 14.10.3 or later.
Which versions of ImageMagick are affected by CVE-2026-25796?
CVE-2026-25796 affects ImageMagick versions prior to 7.1.2-15 and 6.9.13-40.
What type of vulnerability is CVE-2026-25796?
CVE-2026-25796 is a memory leak vulnerability that occurs in the ReadSTEGANOImage function.
Is CVE-2026-25796 related to image processing?
Yes, CVE-2026-25796 is related to image processing as it involves a memory leak in an image handling function of ImageMagick.