CVE-2026-25797: ImageMagick RCE Vulnerability

CVE-2026-25797 Overview

CVE-2026-25797 is a code injection vulnerability affecting ImageMagick, a widely-used open-source software suite for editing and manipulating digital images. The vulnerability exists in the PostScript (PS) coders and HTML encoder components, which fail to properly sanitize input before writing to PostScript headers and HTML documents respectively. This allows attackers to inject arbitrary PostScript or HTML code through malicious image files, which is then executed when the output is processed by printers, viewers like Ghostscript, or web browsers.

Critical Impact

Attackers can inject and execute arbitrary PostScript code when malicious files are processed by printers or viewers, and inject arbitrary HTML code into generated HTML documents, potentially leading to cross-site scripting attacks or further code execution.

Affected Products

• ImageMagick versions prior to 7.1.2-15
• ImageMagick versions prior to 6.9.13-40

Discovery Timeline

• 2026-02-24 - CVE CVE-2026-25797 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-25797

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code - Code Injection). The flaw stems from insufficient input sanitization in two separate ImageMagick components: the PostScript coders and the HTML encoder.

When ImageMagick processes images and generates PostScript output, the PS coders write data directly into PostScript headers without properly escaping or sanitizing the input. Similarly, the HTML encoder fails to properly escape strings when writing to HTML documents. This lack of sanitization creates injection points where attacker-controlled data can be interpreted as executable code rather than data.

The local attack vector requires an attacker to craft a malicious image file containing specially formatted data. When this file is processed by ImageMagick and the output is subsequently rendered by a PostScript interpreter (such as Ghostscript) or displayed in a web browser, the injected code executes with the privileges of the rendering application.

Root Cause

The root cause is improper input validation and missing output encoding in the PostScript coders and HTML encoder modules. These components fail to sanitize user-controlled input before incorporating it into generated PostScript headers and HTML documents, violating the principle of treating all input as untrusted.

Attack Vector

The attack requires local access and involves providing a maliciously crafted image file to ImageMagick for processing. The attacker embeds specially formatted data within the image metadata or content that, when processed by the vulnerable PS coders or HTML encoder, results in arbitrary code being written to the output file. The injected PostScript code executes when the generated file is opened by Ghostscript or sent to a printer, while injected HTML code executes when the HTML output is viewed in a web browser.

The vulnerability mechanism involves insufficient sanitization in the PostScript header generation and HTML string escaping routines. When ImageMagick converts images to PostScript format, attacker-controlled strings are written directly into the PostScript header without proper escaping, allowing PostScript commands to be injected. Similarly, the HTML encoder writes strings to HTML output without proper entity encoding, enabling HTML and JavaScript injection. For complete technical details, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-25797

Indicators of Compromise

• Unusual PostScript commands or syntax appearing in ImageMagick-generated .ps or .eps files
• Unexpected HTML or JavaScript content in ImageMagick-generated HTML output
• Image files with suspicious metadata containing PostScript or HTML syntax
• Ghostscript or printer processes executing unexpected system commands

Detection Strategies

• Monitor ImageMagick processes for unusual input file patterns or suspicious metadata content
• Implement file integrity monitoring on directories where ImageMagick generates output files
• Deploy application-layer firewalls to inspect file uploads for malicious payloads
• Review ImageMagick policy.xml configurations for appropriate coder restrictions

Monitoring Recommendations

• Log all ImageMagick conversion operations with input/output file details
• Monitor Ghostscript and printer spooler processes for anomalous behavior
• Implement content security policies for web applications displaying ImageMagick-generated HTML
• Alert on ImageMagick processes spawning unexpected child processes

How to Mitigate CVE-2026-25797

Immediate Actions Required

• Upgrade ImageMagick to version 7.1.2-15 or later (for 7.x branch)
• Upgrade ImageMagick to version 6.9.13-40 or later (for 6.x branch)
• Review and restrict ImageMagick policy.xml to disable PS and HTML coders if not required
• Audit systems for potentially compromised PostScript or HTML output files

Patch Information

ImageMagick has released patched versions that address this vulnerability. Version 7.1.2-15 and version 6.9.13-40 contain fixes that properly sanitize input before writing to PostScript headers and HTML documents. Users should upgrade to these versions or later. For additional details, see the GitHub Security Advisory.

Workarounds

• Disable the PostScript and HTML coders in ImageMagick's policy.xml configuration if not required for operations
• Run ImageMagick in a sandboxed environment with restricted system access
• Validate and sanitize all input files before processing with ImageMagick
• Avoid opening ImageMagick-generated PostScript files with Ghostscript until patches are applied

# Configuration example - Disable PS and HTML coders in policy.xml
# Add the following lines to /etc/ImageMagick-7/policy.xml or equivalent

<policy domain="coder" rights="none" pattern="PS" />
<policy domain="coder" rights="none" pattern="EPS" />
<policy domain="coder" rights="none" pattern="PDF" />
<policy domain="coder" rights="none" pattern="XPS" />
<policy domain="coder" rights="none" pattern="HTML" />