CVE-2026-25897

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, an Integer Overflow vulnerability exists in the sun decoder. On 32-bit systems/builds, a carefully crafted image can lead to an out of bounds heap write. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122 CWE-190

Affected software

No affected versions have been published.

Timeline

Published: Feb 24, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-258989.1ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the CVE-2026-258997.5Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use of the `fiber_flash` cookie c CVE-2026-25909.8Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Mana CVE-2026-259006.1Lack of output escaping leads to a XSS vector in the feed modules.CVE-2026-259016.1Lack of output escaping leads to a XSS vector in the multilingual associations component.CVE-2026-259036.6Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components that have specific CVE-2026-259045.8The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python co CVE-2026-259055.8The Python code being run by 'runPython' or 'runPythonAsync' is not isolated from the rest of the JS code, allowing any Python code to use t CVE-2026-259067.8Dell Optimizer, versions prior to 6.3.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low priv CVE-2026-259077.5Dell PowerScale OneFS, version 9.13.0.0, contains an overly restrictive account lockout mechanism vulnerability. An unauthenticated attacker CVE-2026-259087.8Dell Alienware Command Center (AWCC), versions prior to 6.13.8.0, contain an Execution with Unnecessary Privileges vulnerability in the AWCC CVE-2026-259164.3Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.