CVE-2026-25969: ImageMagick Memory Leak DOS Vulnerability

CVE-2026-25969 Overview

A memory leak vulnerability has been discovered in ImageMagick, the widely-used open-source software for digital image editing and manipulation. The vulnerability exists in the coders/ashlar.c file, specifically within the WriteASHLARImage function. When an exception is thrown during image processing, allocated memory is not properly released, leading to a memory leak condition that can be exploited to cause denial of service.

Critical Impact

This memory leak vulnerability can be exploited remotely to cause resource exhaustion and denial of service against systems processing images with ImageMagick.

Affected Products

• ImageMagick versions prior to 7.1.2-15
• Applications and services utilizing vulnerable ImageMagick libraries for image processing
• Web applications using ImageMagick for server-side image manipulation

Discovery Timeline

• 2026-02-24 - CVE-2026-25969 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-25969

Vulnerability Analysis

This vulnerability is classified as CWE-401 (Missing Release of Memory after Effective Lifetime), a common memory management flaw in C/C++ applications. The flaw resides in the ASHLAR image coder component of ImageMagick, specifically in the WriteASHLARImage function located in coders/ashlar.c.

During normal operation, the function allocates memory structures to handle image writing operations. However, when an exception occurs during processing, the error handling code path fails to properly deallocate the previously allocated memory. This creates a memory leak where the allocated structure remains in memory without being freed.

In server environments where ImageMagick processes multiple images over time, repeated exploitation of this vulnerability could lead to progressive memory exhaustion, ultimately resulting in service degradation or complete denial of service.

Root Cause

The root cause is improper exception handling in the WriteASHLARImage function. When the function allocates memory for internal structures and subsequently encounters an error condition that triggers an exception, the cleanup code does not properly release the allocated memory before returning. This is a classic resource leak pattern where error paths bypass proper resource cleanup.

Attack Vector

The vulnerability can be exploited remotely over a network connection. An attacker could craft or submit malicious image files designed to trigger exceptions during ASHLAR image writing operations. By repeatedly submitting such files to a vulnerable ImageMagick instance, an attacker can cause progressive memory consumption that eventually exhausts available system resources.

The attack requires no authentication and no user interaction, making it suitable for automated exploitation against web services and applications that process user-supplied images.

The vulnerability manifests in the error handling paths of the WriteASHLARImage function within coders/ashlar.c. When the function allocates internal structures and an exception is subsequently thrown, the allocated memory is not properly released before the function returns. For technical implementation details, see the GitHub Security Advisory.

Detection Methods for CVE-2026-25969

Indicators of Compromise

• Abnormal memory growth in ImageMagick processes over time
• Gradual degradation of system performance on image processing servers
• System logs showing out-of-memory conditions related to ImageMagick operations
• Increased frequency of ImageMagick process restarts due to resource exhaustion

Detection Strategies

• Monitor memory usage patterns for ImageMagick processes to detect unusual growth
• Implement application-level logging to track exception occurrences in image processing operations
• Configure resource limits for ImageMagick processes to contain potential memory exhaustion
• Deploy SentinelOne Singularity Platform to detect anomalous process behavior and resource consumption patterns

Monitoring Recommendations

• Establish baseline memory usage metrics for ImageMagick processes under normal operation
• Set up alerts for memory usage exceeding defined thresholds on systems running ImageMagick
• Monitor for repeated image processing failures that could indicate exploitation attempts
• Review application logs for patterns of exceptions in ASHLAR image operations

How to Mitigate CVE-2026-25969

Immediate Actions Required

• Upgrade ImageMagick to version 7.1.2-15 or later immediately
• Implement resource limits (memory and CPU) for ImageMagick processes as a defense-in-depth measure
• Review and restrict which image formats are enabled in ImageMagick policy configuration
• Consider disabling ASHLAR format support if not required for business operations

Patch Information

ImageMagick version 7.1.2-15 contains the security patch that addresses this memory leak vulnerability. The fix ensures proper memory deallocation in exception handling paths within the WriteASHLARImage function. Users should upgrade to this version or later to remediate the vulnerability. For additional details, refer to the GitHub Security Advisory.

Workarounds

• Implement memory resource limits for ImageMagick processes using system controls such as cgroups
• Disable ASHLAR coder support in ImageMagick policy.xml if this image format is not required
• Deploy application-level rate limiting for image processing requests
• Consider implementing process recycling for long-running ImageMagick instances

# Disable ASHLAR format in ImageMagick policy.xml
# Add to /etc/ImageMagick-7/policy.xml
<policy domain="coder" rights="none" pattern="ASHLAR" />

# Set memory limits for ImageMagick
<policy domain="resource" name="memory" value="256MiB"/>
<policy domain="resource" name="map" value="512MiB"/>