CVE-2026-25637: 
C# vulnerability analysis and mitigation

CVE-2026-25637 is a memory leak vulnerability in the ASHLAR image writer component of ImageMagick, classified as Moderate severity. It affects ImageMagick versions prior to 7.1.2-15 and Magick.NET (the .NET wrapper) versions prior to 14.10.3. The vulnerability was discovered by researcher ylwango613 and disclosed on February 23–24, 2026, via a GitHub Security Advisory (GHSA-gm37-qx7w-p258). It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is CWE-401 (Missing Release of Memory after Effective Lifetime) and CWE-772 (Missing Release of Resource after Effective Lifetime). In coders/ashlar.c, a DrawInfo object was allocated via CloneDrawInfo() before a conditional block, but was only used inside that block — meaning if the label was NULL or processing took certain paths, the allocated object was never freed. The fix, committed as 30ce0e8, moves the DrawInfo allocation inside the conditional block and adds a corresponding DestroyDrawInfo() call to ensure proper cleanup. An attacker exploits this by submitting a crafted image that triggers repeated allocations of small, unreleased heap objects during ASHLAR encoding (GitHub Commit, Github Advisory).

The vulnerability's impact is limited to availability — there is no confidentiality or integrity impact. By repeatedly submitting crafted images to a service backed by a vulnerable ImageMagick instance, an unauthenticated remote attacker can cause the process to consume increasing amounts of heap memory until the system exhausts available memory, resulting in application unresponsiveness or a crash (denial of service). Valgrind analysis confirmed definite memory losses of 3,408 bytes across 3 blocks and indirect losses of 88,885 bytes across 30 blocks per processing run (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.037% (0.000370), indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported (Github Advisory).

The primary remediation is to upgrade ImageMagick to version 7.1.2-15 or later, which contains the patch for this vulnerability. Users of the .NET wrapper Magick.NET should upgrade to version 14.10.3 or later. If immediate patching is not feasible, consider restricting network access to services that process user-supplied images via ImageMagick, or implementing input validation to reject ASHLAR-format image files. Distribution-specific patches have been issued for openSUSE, Debian, and Ubuntu (Github Advisory, Magick.NET Release).