CVE-2026-25898: Imagemagick Has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the UIL and XPM image encoder do not validate the pixel index value returned by GetPixelIndex() before using it as an array subscript. In HDRI builds, Quantum is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Other sources
The UIL and XPM image encoder do not validate the pixel index value returned by GetPixelIndex() before using it as an array subscript. In HDRI builds, Quantum is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash.
READ of size 1 at 0x55a8823a776e thread T0 #0 0x55a880d01e85 in WriteUILImage coders/uil.c:355
READ of size 1 at 0x55fa1c04c66e thread T0 #0 0x55fa1a9ee415 in WriteXPMImage coders/xpm.c:1135
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25898?
CVE-2026-25898 has a high severity due to its potential for a global buffer overflow leading to application crashes or arbitrary code execution.
How do I fix CVE-2026-25898?
To fix CVE-2026-25898, upgrade ImageMagick to version 7.1.2-15 or 6.9.13-40 and later.
What software is affected by CVE-2026-25898?
CVE-2026-25898 affects ImageMagick versions prior to 7.1.2-15 and 6.9.13-40.
Can CVE-2026-25898 lead to data leakage?
Yes, CVE-2026-25898 can potentially lead to data leakage due to the buffer overflow vulnerabilities.
What types of attacks can exploit CVE-2026-25898?
Attackers can exploit CVE-2026-25898 through crafted image files that trigger the buffer overflow in UIL and XPM encoders.