CVE-2026-25637

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a memory leak in the ASHLAR image writer allows an attacker to exhaust process memory by providing a crafted image that results in small objects that are allocated but never freed. Version 7.1.2-15 contains a patch.

PUBLISHED Reserved 2026-02-04 | Published 2026-02-24 | Updated 2026-02-24 | Assigner GitHub_M

Problem types

CWE-401: Missing Release of Memory after Effective Lifetime

Product status

References

github.com/...Magick/security/advisories/GHSA-gm37-qx7w-p258

github.com/...ommit/30ce0e8efbd72fd6b50ed3a10ae22f57c8901137

github.com/dlemstra/Magick.NET/releases/tag/14.10.3

cve.org (CVE-2026-25637)

nvd.nist.gov (CVE-2026-25637)

Download JSON