CVE-2026-25797: 
C# vulnerability analysis and mitigation

CVE-2026-25797 is a code injection vulnerability in ImageMagick affecting its PostScript (ps) and HTML encoders. The ps coders fail to sanitize input before writing it into the PostScript header, and the HTML encoder does not properly escape strings written to HTML documents, allowing an attacker to inject arbitrary PostScript or HTML code via a malicious file. It affects ImageMagick versions prior to 7.1.2-15 (7.x branch) and prior to 6.9.13-40 (6.x branch), as well as Magick.NET NuGet packages prior to version 14.10.3. The vulnerability was published on February 23–24, 2026, with a CVSS v3.1 score of 5.7 (Moderate) per the GitHub Security Advisory, or 5.3 (Medium) per NVD scoring (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). Two distinct flaws exist: (1) the ps/PostScript encoder writes unsanitized user-controlled input directly into the PostScript file header, enabling injection of arbitrary PostScript directives; and (2) the HTML encoder fails to escape special characters in strings written to HTML output documents, enabling HTML injection. Exploitation requires local access — an attacker supplies a crafted image file to ImageMagick for conversion; the resulting PostScript or HTML output file then carries the injected payload. The injected code is not executed by ImageMagick itself but is triggered when the generated file is subsequently processed by a downstream application such as Ghostscript (for PostScript) or a web browser/viewer (for HTML) (Github Advisory, Github Advisory).

Successful exploitation can lead to arbitrary code execution in downstream systems that process the generated PostScript or HTML files — for example, Ghostscript executing injected PostScript commands on behalf of a printer or document viewer. The integrity and availability of downstream systems are at low-to-moderate risk, while confidentiality impact is assessed as none by the GitHub advisory scoring. In environments where ImageMagick automatically converts user-supplied files and the output is rendered or printed without further sanitization, the attack surface extends beyond the ImageMagick process itself to any application in the processing pipeline (Github Advisory, Red Hat Bugzilla).

1. Craft a malicious input file: Prepare an image or document file that, when processed by ImageMagick's ps or HTML encoder, causes unsanitized attacker-controlled content to be embedded in the output. For the ps coder, this involves embedding PostScript metacharacters or directives in image metadata (e.g., EXIF fields, filename, or comment fields) that are written verbatim into the PostScript header.
2. Trigger ImageMagick conversion: Submit the malicious file to a system running a vulnerable version of ImageMagick (< 7.1.2-15 or < 6.9.13-40), causing it to convert the file to PostScript (.ps) or HTML format — for example: convert malicious_input.jpg output.ps.
3. Deliver the poisoned output: The resulting .ps or .html file now contains injected PostScript or HTML code in its header or body.
4. Achieve code execution via downstream processing: When the generated PostScript file is opened by Ghostscript or sent to a printer, the injected PostScript commands are interpreted and executed. For HTML output, injected code executes when the file is rendered in a browser or HTML viewer (Github Advisory, Red Hat Bugzilla).

• File System: Unexpected or anomalous .ps or .html files generated by ImageMagick containing unusual PostScript directives (e.g., systemdict, exec, /bin/sh) in the file header; output files with embedded script tags or JavaScript in HTML output from ImageMagick.
• Process: Ghostscript (gs) spawning unexpected child processes (e.g., shells, network utilities) after processing ImageMagick-generated PostScript files; unusual process trees originating from print spooler or document viewer processes.
• Logs: ImageMagick conversion logs showing processing of files with unusual metadata or filenames containing PostScript/HTML special characters; Ghostscript error logs or execution traces showing unexpected command execution.

Update ImageMagick to version 7.1.2-15 or later (7.x branch) or 6.9.13-40 or later (6.x branch). For .NET users, update Magick.NET NuGet packages to version 14.10.3 or later. As interim mitigations, restrict ImageMagick from processing untrusted or user-supplied files, disable or sandbox PostScript and HTML output encoding where not required, and ensure downstream applications (e.g., Ghostscript) run in restricted environments with limited system access. Patches are also available via Linux distribution security updates for Debian, SUSE, Ubuntu, and Amazon Linux 2 (Github Advisory, Red Hat Bugzilla).

The vulnerability was assigned moderate severity by both the ImageMagick project and GitHub Advisory Database. Red Hat tracked it via Bugzilla and assessed it as medium priority. Multiple Linux distributions — including Debian, SUSE/openSUSE, Ubuntu, and Amazon Linux 2 — issued security advisories and updated packages in the weeks following disclosure. No notable independent researcher commentary or significant social media discussion has been identified beyond standard distribution security announcements (Red Hat Bugzilla, Github Advisory).