CVE-2026-25795: 
C# vulnerability analysis and mitigation

CVE-2026-25795 is a NULL pointer dereference vulnerability in ImageMagick's ReadSFWImage() function (coders/sfw.c) that can cause a denial of service via application crash. When temporary file creation fails during SFW image processing, the read_info structure is destroyed before its filename member is accessed, triggering the dereference. Affected versions include ImageMagick prior to 6.9.13-40 (6.x branch) and prior to 7.1.2-15 (7.x branch), as well as Magick.NET NuGet packages prior to 14.10.3. The vulnerability was published on February 23–24, 2026, with a CVSS v3.1 base score of 5.3 (Moderate) per the GitHub Advisory, though Feedly reports a score of 7.5 (High) under a different scoring interpretation (GitHub Advisory, Red Hat Bugzilla).

The root cause is a use-after-free/NULL pointer dereference (CWE-476) in ReadSFWImage() within coders/sfw.c. When the function attempts to create a temporary file and that creation fails, the read_info object is prematurely destroyed via DestroyImageInfo(). Subsequently, code attempts to access read_info->filename, which now points to freed or NULL memory, causing a fatal crash. The vulnerability is network-exploitable with no privileges or user interaction required — an attacker simply needs to supply a crafted SFW image file to a service that processes images using ImageMagick. AddressSanitizer output confirms the crash at address 0x000000000000, indicating a true NULL dereference (GitHub Advisory, Github Advisory).

Successful exploitation results in a crash of the ImageMagick process, causing a denial of service. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. Services that rely on ImageMagick for image processing (e.g., web applications, media pipelines) could be repeatedly crashed by submitting malicious SFW files, potentially disrupting operations (GitHub Advisory, Red Hat Bugzilla).

1. Identify target: Locate a network-accessible service that processes user-supplied images using a vulnerable version of ImageMagick (prior to 7.1.2-15 or 6.9.13-40), such as a web application with image upload functionality.
2. Craft malicious SFW file: Prepare a specially crafted SFW (Seattle FilmWorks) image file designed to trigger a temporary file creation failure within ReadSFWImage() — for example, by exploiting resource exhaustion conditions or crafting the file to cause the internal temp file logic to fail.
3. Submit the file: Upload or send the crafted SFW image to the target service (e.g., via HTTP file upload, email attachment processing, or any other image ingestion endpoint).
4. Trigger crash: ImageMagick processes the file, ReadSFWImage() fails to create a temporary file, destroys read_info prematurely, then dereferences the NULL filename pointer, causing the process to crash and resulting in denial of service (GitHub Advisory).

• Logs: Application or system logs showing repeated ImageMagick process crashes or segmentation faults when processing SFW image files; AddressSanitizer output referencing UNKNOWN SIGNAL on unknown address 0x000000000000 in the magick binary.
• Process: Unexpected termination of ImageMagick worker processes (magick, convert, or similar) correlated with SFW file processing events.
• File System: Presence of unusual or malformed .sfw files in upload directories or temporary processing folders submitted from external sources.
• Network: Repeated upload requests containing SFW-format files from the same source IP, particularly if followed by service unavailability or error responses (GitHub Advisory).

Upgrade ImageMagick to version 7.1.2-15 or later (7.x branch) or 6.9.13-40 or later (6.9.x branch). For Magick.NET users, upgrade to version 14.10.3 or later. If immediate patching is not feasible, consider disabling SFW image format support in ImageMagick or restricting network access to services that process SFW files. Patches are referenced in commits 332c156 and 55c344f in the ImageMagick repository. Distribution-specific updates have been issued for Debian, Ubuntu (USN-8127-1), SUSE/openSUSE, and Amazon Linux 2 (GitHub Advisory, Github Advisory).

Red Hat tracked the issue via Bugzilla (Bug 2442099) and classified it as medium severity. Multiple Linux distributions — including Debian, Ubuntu, SUSE/openSUSE, and Amazon Linux 2 — issued security advisories and updated packages shortly after disclosure. No notable researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking and distribution patching activity (Red Hat Bugzilla).