CVE-2026-25796: 
C# vulnerability analysis and mitigation

CVE-2026-25796 is a memory leak vulnerability in ImageMagick's ReadSTEGANOImage() function (coders/stegano.c) that can be exploited to cause denial of service. The watermark Image object is not freed on three early-return paths, resulting in a definite memory leak of approximately 13.5KB or more per invocation. It affects ImageMagick versions prior to 7.1.2-15 (7.x branch) and prior to 6.9.13-40 (6.9.x branch), as well as Magick.NET NuGet packages prior to version 14.10.3. The vulnerability was published on February 23–24, 2026. The CVSS v3.1 base score is 5.3 (Moderate) per the GitHub Security Advisory, though some sources report 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-401 (Missing Release of Memory after Effective Lifetime) and CWE-772 (Missing Release of Resource after Effective Lifetime). In ReadSTEGANOImage() within coders/stegano.c, the watermark Image object allocated via AcquireImage() → AcquireCriticalMemory() → AcquireMagickMemory() is not freed when the function exits early on three distinct error paths, leaking approximately 13,512 bytes per call. An unauthenticated remote attacker can trigger this leak by repeatedly submitting crafted STEGANO-format image processing requests to any service backed by a vulnerable ImageMagick installation, with no privileges or user interaction required (GitHub Advisory, Github Advisory).

Successful exploitation results exclusively in an availability impact — there is no confidentiality or integrity risk. By repeatedly invoking the vulnerable STEGANO image decoder, an attacker can progressively exhaust the server's available memory, leading to service degradation, process crashes, or complete system failure. Applications and services that accept user-supplied images and process them with ImageMagick (e.g., web upload handlers, image conversion APIs) are particularly at risk (GitHub Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify services that accept image uploads or process images using ImageMagick (e.g., web applications with file upload functionality, image conversion APIs). Confirm the target is running a vulnerable version (ImageMagick < 7.1.2-15 or < 6.9.13-40).
2. Craft malicious STEGANO image: Prepare a valid or malformed STEGANO-format image file that triggers one of the three early-return error paths in ReadSTEGANOImage(), causing the watermark object to be allocated but not freed.
3. Repeated submission: Automate submission of the crafted image to the target service in a high-frequency loop (e.g., using curl or a scripted HTTP client), causing approximately 13.5KB of memory to leak per request.
4. Memory exhaustion: After sufficient iterations, the server's available memory is depleted, resulting in service degradation, OOM kills, or a complete denial of service condition (GitHub Advisory).

• Network: High-volume HTTP requests submitting STEGANO-format image files to image processing endpoints; unusual sustained traffic from a single source IP targeting upload or conversion endpoints.
• Logs: Application or web server logs showing repeated image processing requests with STEGANO format inputs; error messages from ImageMagick related to STEGANO decoding failures.
• Process/System: Steadily increasing memory consumption by the ImageMagick process or the hosting application over time without corresponding release; OOM (Out of Memory) killer events in system logs (/var/log/syslog, dmesg) terminating ImageMagick-related processes.
• File System: Presence of crafted STEGANO image files in upload directories that trigger processing errors.

Upgrade ImageMagick to version 7.1.2-15 or later (7.x branch) or version 6.9.13-40 or later (6.9.x branch), which contain the fix. For Magick.NET users, upgrade to version 14.10.3 or later. If immediate patching is not possible, restrict network access to ImageMagick-backed services, implement rate limiting on image processing endpoints, and consider blocking or filtering STEGANO-format image inputs at the application layer. Distribution-specific patches have been issued for Debian, Ubuntu (USN-8127-1), SUSE/openSUSE, and Amazon Linux 2 (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by researcher ylwango613 and published by maintainer dlemstra via the ImageMagick GitHub Security Advisory on February 23, 2026. Red Hat tracked it via Bugzilla with medium severity. Multiple Linux distributions (Debian, Ubuntu, SUSE, Amazon Linux) issued security updates in the weeks following disclosure, indicating broad ecosystem attention. No notable social media controversy or significant researcher commentary beyond standard advisory coverage has been observed (GitHub Advisory, Red Hat Bugzilla).