CVE-2026-25795: ImageMagick DOS Vulnerability

CVE-2026-25795 Overview

CVE-2026-25795 is a NULL Pointer Dereference vulnerability affecting ImageMagick, the widely-used open-source software for editing and manipulating digital images. The vulnerability exists in the ReadSFWImage() function within coders/sfw.c, where improper handling of temporary file creation failures leads to a use-after-destroy condition. When temporary file creation fails, the read_info structure is destroyed before its filename member is accessed, causing a NULL pointer dereference that results in an application crash.

Critical Impact

This vulnerability allows remote attackers to cause a denial of service condition by crashing ImageMagick processes through specially crafted image files, potentially disrupting image processing services and workflows.

Affected Products

• ImageMagick versions prior to 7.1.2-15
• ImageMagick versions prior to 6.9.13-40

Discovery Timeline

• 2026-02-24 - CVE CVE-2026-25795 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2026-25795

Vulnerability Analysis

This vulnerability is classified as CWE-476 (NULL Pointer Dereference). The flaw resides in ImageMagick's SFW (Seattle Film Works) image format decoder, specifically within the ReadSFWImage() function located in coders/sfw.c.

The vulnerability is triggered during the image reading process when ImageMagick attempts to create a temporary file but fails. Under normal operation, the function creates a read_info structure to manage image reading metadata, including the temporary filename. However, when temporary file creation fails, the error handling code destroys the read_info structure prematurely. Subsequent code then attempts to access the filename member of the already-destroyed read_info structure, resulting in a NULL pointer dereference.

This type of memory safety issue represents a classic use-after-free pattern where resource cleanup occurs before all references to that resource have been properly handled. The crash is deterministic given the right conditions to trigger temporary file creation failure.

Root Cause

The root cause is improper error handling in the ReadSFWImage() function. The code path that handles temporary file creation failure destroys the read_info structure but fails to exit or return before code that references the structure's members executes. This represents a violation of proper resource lifecycle management, where a pointer is dereferenced after the memory it references has been deallocated.

Attack Vector

An attacker can exploit this vulnerability remotely by supplying a malicious or specially crafted image file to an ImageMagick instance. The attack does not require authentication or user interaction. The exploitation scenario involves:

1. Crafting an image file that triggers the SFW decoder
2. Manipulating conditions to cause temporary file creation to fail (e.g., through resource exhaustion, permission issues, or filesystem constraints)
3. The NULL pointer dereference causes the ImageMagick process to crash

While the vulnerability does not allow code execution, it can be leveraged for denial of service attacks against systems processing untrusted images, such as web applications, content management systems, or image processing pipelines.

Detection Methods for CVE-2026-25795

Indicators of Compromise

• Unexpected ImageMagick process crashes or segmentation faults during image processing operations
• Core dumps indicating NULL pointer dereference in the ReadSFWImage() function or coders/sfw.c
• Repeated failures when processing SFW format images or images that trigger the SFW decoder
• Temporary file creation failures in ImageMagick working directories

Detection Strategies

• Monitor system logs for ImageMagick segmentation fault errors and crashes
• Implement process monitoring to detect abnormal termination of ImageMagick processes
• Deploy application-level crash reporting to capture stack traces from affected components
• Use static analysis tools to identify vulnerable ImageMagick versions in your software inventory

Monitoring Recommendations

• Configure crash dump collection for ImageMagick processes to aid forensic analysis
• Set up alerts for unusual patterns of ImageMagick process restarts or failures
• Monitor filesystem activity in ImageMagick temporary directories for signs of resource exhaustion attacks
• Implement resource usage monitoring to detect attempts to exhaust disk space or file descriptors

How to Mitigate CVE-2026-25795

Immediate Actions Required

• Upgrade ImageMagick to version 7.1.2-15 or later (for 7.x branch)
• Upgrade ImageMagick to version 6.9.13-40 or later (for 6.x branch)
• Review and restrict image processing to trusted sources where possible
• Implement input validation to filter potentially malicious image uploads

Patch Information

ImageMagick has released patched versions that properly handle temporary file creation failures. The fix ensures that the read_info structure is not accessed after being destroyed, preventing the NULL pointer dereference. For detailed patch information, see the GitHub Security Advisory.

Apply the following version updates:

• For ImageMagick 7.x: Update to version 7.1.2-15 or later
• For ImageMagick 6.x: Update to version 6.9.13-40 or later

Workarounds

• Disable the SFW coder by removing or renaming coders/sfw.la and coders/sfw.so if SFW image support is not required
• Implement ImageMagick policy restrictions using policy.xml to block potentially dangerous image formats
• Run ImageMagick processes in sandboxed environments to limit the impact of crashes
• Deploy process supervision to automatically restart crashed ImageMagick instances

# Configuration example - Disable SFW coder in ImageMagick policy.xml
# Add this to /etc/ImageMagick-7/policy.xml or equivalent
<policy domain="coder" rights="none" pattern="SFW" />