CVE-2026-25576: 
C# vulnerability analysis and mitigation

CVE-2026-25576 is a heap buffer over-read vulnerability in ImageMagick affecting multiple raw image format coders (BGR, CMYK, GRAY, RAW, RGB, YCbCr). The flaw exists in ImageMagick versions prior to 7.1.2-15 (7.x branch) and prior to 6.9.13-40 (6.x branch), as well as Magick.NET prior to version 14.10.3. It was disclosed on February 23–24, 2026, via a GitHub Security Advisory (GHSA-jv4p-gjwq-9r2j). The vulnerability carries a CVSS v3.1 base score of 5.1 (Moderate) per the GitHub Advisory, or 5.5 (Medium) per NVD scoring (GitHub Advisory, Red Hat Bugzilla).

The root cause is an out-of-bounds read (CWE-125) and heap-based buffer over-read (CWE-122) in multiple raw image format handlers within ImageMagick's coders — specifically bgr.c, cmyk.c, gray.c, raw.c, rgb.c, and ycbcr.c. The vulnerability is triggered when an image is processed with -extract dimensions larger than the -size dimensions: the pixel-copying loop iterates using image->columns (the larger extract dimension) rather than the smaller canvas_image->columns, causing reads beyond the bounds of the heap-allocated canvas buffer. The fix introduces a columns variable set to MagickMin(image->columns, canvas_image->columns) and uses it as the loop bound, preventing over-read (GitHub Commit, GitHub Advisory). Exploitation requires local access and the ability to supply a crafted raw image file with mismatched dimensions.

Successful exploitation allows an attacker to read out-of-bounds heap memory, potentially disclosing sensitive information present in the process's heap at the time of image processing. The impact is limited to confidentiality — there is no integrity or availability impact. The attack vector is local, meaning the attacker must have the ability to supply a crafted image to a vulnerable ImageMagick process, which limits the scope of exposure but is relevant in shared hosting, image processing pipelines, or web applications that process user-supplied raw image files (GitHub Advisory, Red Hat Bugzilla).

1. Craft a malicious raw image file: Create a raw image file (e.g., BGR, CMYK, GRAY, or RAW format) where the -extract dimensions (width/height) are set larger than the -size dimensions, causing a mismatch between the canvas buffer size and the expected pixel read count.
2. Deliver the image to the target: Place the crafted image in a location accessible to a vulnerable ImageMagick process — for example, upload it to a web application that processes user-supplied images, or provide it directly on a shared system.
3. Trigger image processing: Cause ImageMagick to process the crafted file using a command such as convert -size WxH -extract W2xH2 malicious.bgr output.png, where W2 > W and H2 > H.
4. Observe heap memory disclosure: The vulnerable pixel-copying loop reads beyond the allocated canvas buffer, potentially exposing adjacent heap memory contents. An attacker with the ability to observe the output or error output may be able to extract sensitive data from the process heap (GitHub Commit, GitHub Advisory).

• Process: ImageMagick (convert, magick) processes invoked with both -size and -extract options where extract dimensions exceed size dimensions; unexpected crashes or memory errors in ImageMagick processes.
• Logs: Application logs showing ImageMagick processing raw format files (.bgr, .cmyk, .gray, .raw, .rgb, .ycbcr) with mismatched dimension parameters; error messages referencing out-of-bounds memory access or segmentation faults in image coders.
• File System: Presence of unusually crafted raw image files with mismatched -size and -extract metadata in upload directories or temporary processing folders.

Upgrade ImageMagick to version 7.1.2-15 or later (7.x branch) or 6.9.13-40 or later (6.x branch). Magick.NET users should upgrade to version 14.10.3 or later. As a workaround, restrict local access to systems running ImageMagick and implement input validation to reject raw image files with mismatched -extract and -size dimensions before processing. Linux distribution users should apply vendor-provided security updates (available for Debian, SUSE, Ubuntu, Amazon Linux 2, and openSUSE) (GitHub Advisory, Magick.NET Release).

Red Hat tracked the vulnerability via Bugzilla (Bug 2442093) and assigned it medium severity, with downstream packages under review. Multiple Linux distributions including Debian, SUSE, openSUSE, Ubuntu, and Amazon Linux 2 issued security advisories and package updates following the disclosure. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability database and distribution advisory coverage (Red Hat Bugzilla).