CVE-2026-25794: 
C# vulnerability analysis and mitigation

CVE-2026-25794 is a heap-buffer-overflow vulnerability in ImageMagick caused by a signed integer overflow in the WriteUHDRImage function within coders/uhdr.c. When processing images with large dimensions, 32-bit int arithmetic used to compute the pixel buffer size overflows, resulting in an undersized heap allocation followed by an out-of-bounds write. All ImageMagick versions prior to 7.1.2-15 are affected, as are Magick.NET NuGet packages prior to version 14.10.3. The vulnerability was published on February 23–24, 2026, and carries a CVSS v3.1 base score of 8.2 (High) (GitHub Advisory, Github Advisory DB).

The root cause is an integer overflow (CWE-190) in WriteUHDRImage (coders/uhdr.c, line 807), where the product of image width and height is computed using signed 32-bit int arithmetic. For sufficiently large image dimensions, this multiplication wraps around to a small or negative value, causing malloc() to allocate an undersized heap buffer — a classic heap-based buffer overflow (CWE-122). An attacker exploits this by supplying a crafted image file with large declared dimensions to any service or application that processes UHDR images via ImageMagick; no authentication or user interaction is required. AddressSanitizer output confirms a WRITE of size 8 at the overflow site in WriteUHDRImage (GitHub Advisory).

Successful exploitation can crash the ImageMagick process (denial of service) or, in more severe cases, result in an out-of-bounds heap write that could potentially enable arbitrary code execution. The vulnerability has high availability impact and low confidentiality impact, with no integrity impact per the CVSS scoring. Services that accept untrusted image uploads and process them with ImageMagick — such as web applications, media pipelines, and document converters — are at greatest risk, as exploitation requires no privileges or user interaction (Github Advisory DB, Red Hat Bugzilla).

1. Reconnaissance: Identify web applications or services that accept image uploads and process them server-side using ImageMagick (e.g., image resizing, conversion, or thumbnail generation endpoints). Confirm the ImageMagick version is prior to 7.1.2-15 via error messages, HTTP headers, or version disclosure.
2. Craft malicious UHDR image: Create a UHDR-format image file with extremely large declared width and height values (e.g., dimensions near or exceeding the 32-bit integer maximum, such as 46341 × 46341 pixels) so that the product overflows a signed 32-bit integer.
3. Submit the image: Upload or submit the crafted image file to the target service via its image upload or processing endpoint.
4. Trigger the overflow: When ImageMagick's WriteUHDRImage function processes the file, the integer overflow causes an undersized heap buffer to be allocated, followed by an out-of-bounds write at coders/uhdr.c:807.
5. Achieve impact: At minimum, the process crashes (denial of service). With heap layout control, an attacker may attempt to leverage the out-of-bounds write for arbitrary code execution, depending on memory allocator behavior and available mitigations (GitHub Advisory).

• Logs: Application or system logs showing ImageMagick process crashes or segmentation faults when processing UHDR image files; AddressSanitizer output referencing heap-buffer-overflow in WriteUHDRImage at coders/uhdr.c:807.
• File System: Presence of unusually large or malformed UHDR image files in upload directories or temporary processing folders.
• Process: Unexpected termination of ImageMagick worker processes (convert, magick) shortly after processing uploaded image files; core dump files generated in the ImageMagick working directory.
• Network: Repeated upload requests containing UHDR image files with anomalously large dimension metadata from a single source IP, potentially indicating automated exploitation attempts.

The primary remediation is to upgrade ImageMagick to version 7.1.2-15 or later, which contains the patch for this vulnerability (GitHub Advisory). Magick.NET users should upgrade all affected NuGet packages to version 14.10.3 or later (Github Advisory DB). If immediate patching is not feasible, mitigations include: restricting network access to services that process untrusted image files, implementing input validation to reject images with excessive dimensions before they reach ImageMagick, and disabling UHDR image format processing if it is not required by the application (Feedly).

The vulnerability was reported by researcher ylwango613 and disclosed by ImageMagick maintainer dlemstra via GitHub Security Advisories on February 23, 2026 (GitHub Advisory). Red Hat tracked the issue via Bugzilla (Bug 2442110) and classified it as high severity (Red Hat Bugzilla). Downstream Linux distributions including Debian and Ubuntu subsequently issued security updates for their ImageMagick packages. Social media activity was limited, with brief mentions on Mastodon and Bluesky shortly after disclosure.