CVE-2026-25988: 
C# vulnerability analysis and mitigation

CVE-2026-25988 is a memory leak vulnerability in ImageMagick caused by the MSL image stack index failing to refresh, resulting in images being stored in incorrect memory slots and never freed on error. It affects ImageMagick versions prior to 7.1.2-15 (in the 7.x branch) and prior to 6.9.13-40 (in the 6.x branch), as well as Magick.NET NuGet packages prior to version 14.10.3. The vulnerability was published on February 23–24, 2026, and was reported by researcher ylwango613. It carries a CVSS v3.1 base score of 5.3 (Moderate) per the GitHub Security Advisory, though some sources score it as high as 7.5 (GitHub Advisory, Red Hat Bugzilla).

The root cause is an improper update of the stack index in msl.c (CWE-401: Missing Release of Memory after Effective Lifetime; CWE-911: Improper Update of Reference Count). When processing MSL (Magick Scripting Language) image inputs, the stack index is not refreshed correctly, causing an image object to be stored in the wrong memory slot. On error conditions, this misplaced image is never freed, resulting in a memory leak. The vulnerability is remotely exploitable with no authentication or user interaction required, as an attacker can supply a crafted image file to a network-accessible ImageMagick service. LeakSanitizer output confirms direct leaks of at least 13,512 bytes per occurrence (GitHub Advisory, Github Advisory).

Successful exploitation causes memory to be progressively leaked from the ImageMagick process, potentially exhausting system memory over time and leading to service degradation or application crashes — a denial-of-service condition. There is no impact on confidentiality or data integrity; the vulnerability is limited to availability. In environments where ImageMagick processes large volumes of user-supplied images (e.g., web applications, media pipelines), repeated exploitation could cause sustained service interruptions (GitHub Advisory, Red Hat Bugzilla).

Upgrade ImageMagick to version 7.1.2-15 or later (7.x branch) or 6.9.13-40 or later (6.x branch). For .NET users, update Magick.NET NuGet packages to version 14.10.3 or later. If immediate patching is not feasible, limit network exposure to ImageMagick services, enforce strict input validation on image files, and monitor memory consumption of ImageMagick processes for abnormal growth. Security updates have been issued by downstream distributors including Debian, Ubuntu (USN-8127-1), SUSE/openSUSE, and Amazon Linux 2 (GitHub Advisory, Github Advisory).

The vulnerability was disclosed by the ImageMagick project maintainer (dlemstra) via a GitHub Security Advisory on February 23, 2026, with credit to reporter ylwango613. Red Hat, Debian, Ubuntu, SUSE/openSUSE, and Amazon Linux have all issued downstream security advisories and package updates. No notable researcher commentary or significant social media discussion has been observed beyond standard vulnerability tracking and patch announcements (GitHub Advisory, Red Hat Bugzilla).