CVE-2026-105825: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-105825 is a denial-of-service vulnerability in ImageMagick's XMP profile handling, where a crafted XMP profile causes the process to terminate rather than raising an exception. It affects ImageMagick versions before 6.9.13-55 (6.x branch) and before 7.1.2-30 (7.x branch). The CVE has been marked as Rejected (duplicate) by the CVE authority, with the canonical advisory tracked under GHSA-27m9-54jx-fgvq and CVE-2026-107208. It carries a CVSS v3.1 score of 5.3 (Medium) and a CVSS v4.0 score of 6.9 (Medium) (GitHub Advisory, ImageMagick Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-617 (Reachable Assertion), with the canonical advisory also referencing CWE-674 (Uncontrolled Recursion). When ImageMagick processes an image containing a specially crafted XMP profile, the malformed profile triggers an assertion or uncontrolled recursion that terminates the process outright instead of being caught and handled as an exception. The attack vector is network-based, requires no authentication or user interaction, and is exploitable simply by supplying a malicious image file to any application that uses ImageMagick for image processing (ImageMagick Advisory, GitHub Advisory). The vulnerability was reported by researcher Yanhaoxi (ImageMagick Advisory).

Successful exploitation results in a denial-of-service condition: the ImageMagick process crashes, disrupting any application that relies on it for image processing (e.g., web applications, media pipelines, document converters). There is no impact on confidentiality or integrity — only availability is affected. Repeated submission of malicious images could cause persistent service disruption, particularly in automated or publicly accessible image-processing workflows (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.304% (21st percentile), indicating a low near-term exploitation probability. The attack is automatable — an unauthenticated attacker can trigger it remotely without user interaction by submitting a crafted image file (GitHub Advisory).

1. Identify target: Locate a web application, API, or service that accepts image uploads and processes them using a vulnerable version of ImageMagick (before 6.9.13-55 or 7.x before 7.1.2-30).
2. Craft malicious image: Create or obtain an image file containing a specially crafted XMP profile designed to trigger the reachable assertion or uncontrolled recursion in ImageMagick's XMP parsing code.
3. Submit the image: Upload or send the crafted image to the target service via its normal image submission interface (e.g., HTTP file upload, email attachment, API endpoint).
4. Trigger crash: When the server-side ImageMagick process parses the malicious XMP profile, it terminates abruptly instead of raising a handled exception, causing a denial-of-service condition for the affected application.
5. Repeat for persistence: Repeatedly submit the malicious image to maintain the denial-of-service state if the application automatically restarts the ImageMagick process (ImageMagick Advisory, GitHub Advisory).

• Logs: Unexpected ImageMagick process termination errors in application logs; crash reports or core dumps referencing XMP profile parsing; assertion failure messages in ImageMagick stderr output.
• Process: Repeated abnormal termination of the ImageMagick process (e.g., convert, magick) without a corresponding handled exception; application restart loops triggered by ImageMagick crashes.
• File System: Presence of core dump files (e.g., core.*) in the working directory of the ImageMagick process; suspicious image files with oversized or malformed XMP metadata blocks in upload directories.
• Network: High volume of image upload requests from a single source IP, particularly with files containing large or unusual XMP profile sections.

Upgrade ImageMagick to version 6.9.13-55 or later (6.x branch) or 7.1.2-30 or later (7.x branch), which contain fixes for this vulnerability (ImageMagick Advisory). As interim mitigations, implement input validation and file-type sanitization before passing images to ImageMagick, and consider using ImageMagick's policy configuration (policy.xml) to restrict processing of potentially dangerous file formats or metadata. Restricting public access to image-processing endpoints and monitoring for unexpected process terminations can further reduce exposure (Red Hat Bugzilla).

The vulnerability was reported by researcher Yanhaoxi and disclosed by ImageMagick maintainer dlemstra via a GitHub Security Advisory. Red Hat has opened a tracking bug (Bugzilla #2547974) and assigned it medium priority/severity. No significant broader media coverage or notable community commentary beyond standard vulnerability tracking has been observed (ImageMagick Advisory, Red Hat Bugzilla).