CVE-2026-25637: ImageMagick DOS Vulnerability

CVE-2026-25637 Overview

CVE-2026-25637 is a memory leak vulnerability in ImageMagick, the open-source image processing library. The flaw resides in the ASHLAR image writer, which allocates small DrawInfo objects when processing image labels but fails to free them. An attacker can supply a crafted image that forces repeated allocations, gradually exhausting process memory. The issue is classified as CWE-401: Missing Release of Memory after Effective Lifetime. ImageMagick versions prior to 7.1.2-15 are affected, along with the Magick.NET .NET binding maintained by dlemstra. The vulnerability is exploitable remotely without authentication when applications expose ImageMagick to untrusted image input.

Critical Impact
Crafted images processed by the ASHLAR writer can exhaust server memory, leading to denial of service in applications that accept untrusted image uploads.

Affected Products

ImageMagick versions prior to 7.1.2-15
Magick.NET versions prior to 14.10.3
Applications and services embedding vulnerable ImageMagick builds for image conversion

Discovery Timeline

2026-02-24 - CVE-2026-25637 published to NVD
2026-02-27 - Last updated in NVD database

Technical Details for CVE-2026-25637

Vulnerability Analysis

The vulnerability exists in coders/ashlar.c, the source file implementing the ASHLAR image writer. During tile annotation, the writer calls CloneDrawInfo() to allocate a DrawInfo structure used for rendering image labels. The allocation occurs unconditionally inside a loop iterating over tiles, but the corresponding DestroyDrawInfo() call is missing. Each processed tile that yields a non-null label leaks a DrawInfo structure plus its associated string allocations. An attacker who controls input to an ImageMagick conversion pipeline can submit an image with many tiles, triggering repeated leaks within a single conversion call. Sustained or batched requests against a service that writes ASHLAR output amplify the leak until the process exhausts its address space and terminates.

Root Cause

The root cause is a lifetime mismatch between allocation and deallocation. CloneDrawInfo() runs for every loop iteration, but DestroyDrawInfo() was never invoked, violating the resource management contract expected by the ImageMagick API.

Attack Vector

Exploitation requires the target application to process attacker-supplied input through the ASHLAR writer. Web applications that accept image uploads and perform server-side conversion are the primary attack surface. No authentication or user interaction is needed when the conversion endpoint is publicly reachable.

           *label,
           offset[MagickPathExtent];
 
-        DrawInfo
-          *draw_info = CloneDrawInfo(image_info,(DrawInfo *) NULL);
-
         label=InterpretImageProperties((ImageInfo *) image_info,tile_image,
           value,exception);
         if (label != (const char *) NULL)
           {
+            DrawInfo
+              *draw_info = CloneDrawInfo(image_info,(DrawInfo *) NULL);
+
             (void) CloneString(&draw_info->text,label);
             label=DestroyString(label);
             (void) FormatLocaleString(offset,MagickPathExtent,"%+g%+g",(double)
               tiles[i].x+geometry.x,(double) tiles[i].height+tiles[i].y-
               geometry.y/2.0+4);
             (void) CloneString(&draw_info->geometry,offset);
             status=AnnotateImage(ashlar_image,draw_info,exception);
+            draw_info=DestroyDrawInfo(draw_info);
           }
       }
 #if defined(MAGICKCORE_OPENMP_SUPPORT)

Source: ImageMagick commit 30ce0e8. The patch moves the CloneDrawInfo() allocation inside the label != NULL branch and adds the matching DestroyDrawInfo() call to release the structure after annotation completes.

Detection Methods for CVE-2026-25637

Indicators of Compromise

ImageMagick or magick worker processes with steadily increasing resident memory while serving image conversion requests
Repeated out-of-memory kills or OOMKilled Kubernetes pod events tied to image processing workloads
Conversion requests targeting the ASHLAR output format from untrusted sources

Detection Strategies

Inventory ImageMagick installations and verify whether builds are below version 7.1.2-15 using magick -version or package manager output
Audit application code for calls that write images in the ASHLAR format and trace which inputs reach those calls
Review web application logs for batches of image conversion requests originating from a single source within short time windows

Monitoring Recommendations

Set memory limits and alert thresholds on processes that invoke ImageMagick so leaks trigger detection before causing service outage
Track ImageMagick CVE feeds and the ImageMagick security advisories page for related disclosures
Log image format, dimensions, and source IP for each conversion request to support post-incident analysis

How to Mitigate CVE-2026-25637

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-15 or later on all servers that process untrusted images
Upgrade Magick.NET to version 14.10.3 or later in .NET applications relying on the affected binding
Restart long-running services after upgrading so they load the patched library into memory

Patch Information

The fix is delivered in ImageMagick commit 30ce0e8efbd72fd6b50ed3a10ae22f57c8901137 and shipped in release 7.1.2-15. See the GitHub Security Advisory GHSA-gm37-qx7w-p258 and the Magick.NET 14.10.3 release notes for vendor guidance.

Workarounds

Disable the ASHLAR coder in ImageMagick's policy.xml if patching cannot be performed immediately
Restrict the output formats permitted by application logic to exclude ASHLAR for untrusted input
Enforce per-request memory and CPU limits on image conversion workers using cgroups, container limits, or ulimit

bash

# /etc/ImageMagick-7/policy.xml - disable ASHLAR writer until patched
<policymap>
  <policy domain="coder" rights="none" pattern="ASHLAR" />
</policymap>