CVE-2026-25987: ImageMagick has heap buffer over-read in MAP image decoder
A heap buffer over-read vulnerability exists in the MAP image decoder when processing crafted MAP files, potentially leading to crashes or unintended memory disclosure during image decoding.
================================================================= ==4070926==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000002b31 at pc 0x56517afbd910 bp 0x7ffc59e90000 sp 0x7ffc59e8fff0 READ of size 1 at 0x502000002b31 thread T0
Other sources
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the MAP image decoder when processing crafted MAP files, potentially leading to crashes or unintended memory disclosure during image decoding. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25987?
CVE-2026-25987 has been classified as a high severity vulnerability due to the potential for heap buffer over-read.
How do I fix CVE-2026-25987?
To fix CVE-2026-25987, upgrade ImageMagick to version 7.1.2-15 or 6.9.13-40 or later.
What are the affected versions of ImageMagick for CVE-2026-25987?
Affected versions for CVE-2026-25987 are prior to 7.1.2-15 and 6.9.13-40.
What types of files does CVE-2026-25987 affect?
CVE-2026-25987 affects crafted MAP files processed by the ImageMagick MAP image decoder.
Is CVE-2026-25987 a remote exploitation risk?
Yes, CVE-2026-25987 can be exploited remotely if an application processes malicious MAP files.