CVE-2026-25638: 
C# vulnerability analysis and mitigation

CVE-2026-25638 is a memory leak vulnerability in ImageMagick's MSL (Magick Scripting Language) image coder, specifically within the WriteMSLImage function in coders/msl.c. The function allocates resources but returns early without releasing them, enabling a network attacker to exhaust system memory and cause denial of service. It affects ImageMagick versions prior to 7.1.2-15 (7.x branch) and prior to 6.9.13-40 (6.x branch), as well as Magick.NET NuGet packages prior to version 14.10.3. Disclosed on February 23–24, 2026, it carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime) and CWE-772 (Missing Release of Resource after Effective Lifetime). In the WriteMSLImage function within coders/msl.c, memory is allocated via malloc during MSL image processing, but certain early-return code paths fail to free those allocations before exiting. Valgrind analysis confirmed approximately 177,196 bytes (13,512 direct, 163,684 indirect) are definitively lost per invocation. An unauthenticated remote attacker can trigger this leak by submitting crafted MSL image files to any service that processes them with ImageMagick, requiring no privileges or user interaction (GitHub Advisory, Github Advisory).

Successful exploitation results in progressive memory exhaustion on the affected host, with no impact to confidentiality or data integrity. Repeated submission of malicious MSL image files can degrade or fully deny availability of the ImageMagick service and potentially destabilize the host operating system if memory is sufficiently exhausted. Systems that expose ImageMagick-based image processing over a network (e.g., web applications, media processing pipelines) are at greatest risk (GitHub Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify services or web applications that accept image uploads and process them using ImageMagick versions prior to 7.1.2-15 or 6.9.13-40, particularly those that handle MSL format files.
2. Craft malicious MSL file: Prepare an MSL image file (.msl) designed to trigger the WriteMSLImage function's early-return code path, causing resource allocation without subsequent deallocation.
3. Submit repeatedly: Upload or submit the crafted MSL file to the target service repeatedly in rapid succession, causing cumulative memory leaks with each processing invocation.
4. Monitor for impact: Observe the target service for signs of memory exhaustion — increasing response latency, out-of-memory errors, or service crashes — indicating successful denial of service (GitHub Advisory).

• Network: High volume of MSL image file upload requests from a single or small set of source IPs to an ImageMagick-backed service endpoint.
• System Resources: Steadily increasing memory consumption by the ImageMagick process (convert, magick, or application worker processes) without corresponding release; OOM killer events in system logs.
• Logs: Application or web server logs showing repeated processing of .msl files or MSL-format image submissions; error messages related to memory allocation failures in ImageMagick logs.
• Process: ImageMagick worker processes consuming abnormally large amounts of RSS/VSZ memory as reported by tools like top, htop, or ps.

Upgrade ImageMagick to version 7.1.2-15 or later (7.x branch) or 6.9.13-40 or later (6.x branch); Magick.NET users should upgrade to version 14.10.3 or later. As an interim workaround, restrict network access to services that process MSL image files, or disable MSL coder support in ImageMagick's policy configuration (/etc/ImageMagick-*/policy.xml) by setting <policy domain="coder" rights="none" pattern="MSL" />. Monitor system memory usage on affected hosts for signs of exhaustion until patching is complete (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by researcher unbengable12 and patched by ImageMagick maintainer dlemstra. Multiple Linux distributions including SUSE, Debian, and Ubuntu have issued security advisories and updated packages. Red Hat tracked the issue via Bugzilla and classified it as medium severity. No significant social media discussion or notable researcher commentary beyond standard distribution advisories has been observed (GitHub Advisory, Red Hat Bugzilla).