CVE-2026-25970: 
C# vulnerability analysis and mitigation

CVE-2026-25970 is a signed integer overflow vulnerability in ImageMagick's SIXEL decoder that allows an unauthenticated remote attacker to trigger memory corruption and denial of service by supplying a maliciously crafted SIXEL image file. It affects ImageMagick versions prior to 7.1.2-15 (7.x branch) and prior to 6.9.13-40 (6.x branch), as well as Magick.NET NuGet packages prior to version 14.10.3. The vulnerability was published on February 23–24, 2026, with patches released simultaneously. The CVSS v3.1 base score is 7.5 (High) per NVD, while the GitHub Security Advisory rates it 5.3 (Moderate) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a CWE-190 (Integer Overflow or Wraparound) flaw in the SIXEL image decoder component of ImageMagick. During buffer reallocation operations, pointer arithmetic is performed using signed 32-bit integers; when the computed value exceeds the maximum representable value for a signed 32-bit integer, it wraps to a negative or very small number, causing the subsequent memory allocation or access to be incorrect and resulting in memory corruption. The attack requires no authentication, no user interaction, and is reachable over the network by submitting a crafted SIXEL file to any service that processes images via ImageMagick. An AddressSanitizer crash (DEADLYSIGNAL / UNKNOWN SIGNAL at address 0x000000000000) was included in the advisory as a proof-of-concept crash trace (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in memory corruption within the ImageMagick process, leading to a crash and denial of service. There is no known confidentiality or integrity impact — the vulnerability is limited to availability. Any service or application that automatically processes user-supplied SIXEL images through a vulnerable ImageMagick version is at risk of being crashed or rendered unavailable by a single malicious file submission (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of this report. The EPSS score is approximately 0.039–0.059% (19th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Nessus (IDs: 300033, 301556, 301797, 301802, 301807, 301809, 301813, 301896) and Qualys (ID: 362069) (GitHub Advisory, Feedly).

1. Identify target: Locate a service or application that accepts image uploads or processes remote images using a vulnerable version of ImageMagick (prior to 7.1.2-15 or 6.9.13-40), such as a web application with image conversion functionality.
2. Craft malicious SIXEL file: Create a specially crafted SIXEL image file designed to trigger the signed 32-bit integer overflow during buffer reallocation in the SIXEL decoder. The overflow must cause pointer arithmetic to produce an invalid (e.g., negative or near-zero) buffer size.
3. Submit the file: Upload or otherwise deliver the malicious SIXEL file to the target service — for example, via a file upload form, an API endpoint, or an email attachment processed by an image-handling pipeline.
4. Trigger crash: ImageMagick processes the file, the integer overflow occurs during buffer reallocation, memory corruption results, and the ImageMagick process crashes, causing denial of service for the affected application or service (GitHub Advisory).

• Logs: Application or system logs showing ImageMagick process crashes or abnormal terminations when processing SIXEL (.six, .sixel) image files; AddressSanitizer output containing DEADLYSIGNAL or UNKNOWN SIGNAL at address 0x000000000000.
• Process: Unexpected termination of ImageMagick (convert, magick) processes with signal-related exit codes (e.g., SIGSEGV, SIGABRT) shortly after receiving image input.
• File System: Presence of unusual or unexpected SIXEL image files (.six, .sixel extensions) in upload directories or temporary processing folders.
• Network: Repeated submission of SIXEL-format image files from a single source IP to an image-processing endpoint, particularly if followed by service unavailability (GitHub Advisory).

Upgrade ImageMagick to version 7.1.2-15 or later (7.x branch) or 6.9.13-40 or later (6.x branch); Magick.NET users should upgrade to 14.10.3 or later. As a temporary workaround where patching is not immediately possible, restrict or disable SIXEL image format processing in ImageMagick's policy configuration (/etc/ImageMagick-*/policy.xml) by adding a deny rule for the SIXEL coder. Downstream distributions including Debian, Ubuntu, SUSE/openSUSE, and Amazon Linux 2 have released updated packages (GitHub Advisory, Ubuntu Advisory).

The vulnerability was reported by researcher ylwango613 and disclosed by ImageMagick maintainer dlemstra via the GitHub Security Advisory on February 23, 2026. Multiple Linux distributions — including Debian, Ubuntu, SUSE/openSUSE, and Amazon Linux 2 — issued security advisories and updated packages within weeks of disclosure, indicating prompt vendor response. Coverage was picked up by Linux security news aggregators and distribution security mailing lists (GitHub Advisory, Ubuntu Advisory).