CVE-2026-105825: 
ImageMagick Análisis y mitigación de vulnerabilidades

CVE-2026-105825 is a denial-of-service vulnerability in ImageMagick's XMP profile handling, where a crafted XMP profile causes the process to terminate abruptly instead of raising a catchable exception. It affects ImageMagick versions before 6.9.13-55 (6.x branch) and before 7.1.2-30 (7.x branch). The vulnerability was published on October 8, 2026, with the underlying security advisory (GHSA-27m9-54jx-fgvq) credited to reporter Yanhaoxi and published September 21, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, ImageMagick Advisory).

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-617 (Reachable Assertion), with the upstream advisory also noting CWE-674 (Uncontrolled Recursion) as a contributing weakness (ImageMagick Advisory, GitHub Advisory). When ImageMagick parses a specially crafted XMP profile embedded in an image file, an internal assertion or uncontrolled recursion condition is triggered that terminates the process rather than propagating a recoverable exception to the calling application. Exploitation requires no authentication, no special privileges, and no user interaction — an attacker simply needs to supply a malicious image file to any service or application that processes images via ImageMagick (Feedly). No public proof-of-concept code has been identified at this time.

Successful exploitation causes the ImageMagick process — and potentially the host application relying on it — to crash, resulting in a denial of service. The impact is limited to availability; there is no confidentiality or integrity impact, and no evidence of code execution or data exfiltration potential (GitHub Advisory). Applications that automatically process user-supplied images (e.g., web upload services, content management systems, media pipelines) are particularly at risk, as repeated submission of malicious images could cause persistent service disruption (Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term (GitHub Advisory). The vulnerability is automatable (no user interaction or privileges required), meaning a network-based attacker could repeatedly submit crafted images to trigger crashes at scale. CVE-2026-105825 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify a target: Locate a web application or service that accepts image uploads and processes them using a vulnerable version of ImageMagick (before 6.9.13-55 or 7.x before 7.1.2-30).
2. Craft a malicious image: Create or obtain an image file (e.g., JPEG, PNG, TIFF) containing a specially crafted XMP metadata profile designed to trigger the uncontrolled recursion or reachable assertion in ImageMagick's XMP parser.
3. Submit the image: Upload or otherwise supply the crafted image to the target service via its normal image intake mechanism (e.g., HTTP file upload endpoint).
4. Trigger the crash: ImageMagick processes the XMP profile, hits the assertion/recursion condition, and terminates the process instead of raising an exception, causing the application or service to crash.
5. Repeat for sustained DoS: Resubmit the malicious image repeatedly to prevent service recovery, achieving a sustained denial-of-service condition (ImageMagick Advisory, Feedly).

• Logs: Sudden, unexplained termination of the ImageMagick process or the parent application process in system/application logs; error messages referencing XMP profile parsing failures or assertion errors in ImageMagick logs.
• File System: Presence of image files with anomalous or oversized XMP metadata sections in upload directories or temporary processing folders.
• Process: Repeated crashes or restarts of image-processing worker processes (e.g., via process supervisors like systemd or supervisord); core dump files generated by the ImageMagick process.
• Network: High volume of image upload requests from a single source IP, particularly if correlated with service crashes; repeated submissions of the same or similarly structured image files.

Upgrade ImageMagick to version 6.9.13-55 or later (for the 6.x branch) or to version 7.1.2-30 or later (for the 7.x branch), as these releases contain the fix (ImageMagick Advisory). As interim mitigations, implement input validation and sanitization for image files before passing them to ImageMagick, and consider stripping or rejecting XMP metadata from untrusted image uploads using a separate, safe tool. Restricting access to image processing endpoints and monitoring for unexpected process terminations can help detect and limit exploitation attempts (Feedly, Red Hat Bugzilla).