CVE-2026-25897 is an integer overflow in ImageMagick's Sun image decoder, rated 6.5. On 32-bit builds, a crafted image can cause an out of bounds heap write. Versions before 7.1.2-15 and 6.9.13-40 are affected, and those releases contain the patch. Rebuild container images that bundle ImageMagick as well.
What's affected
- Product: ImageMagick, versions before 7.1.2-15 on the 7.x line and before 6.9.13-40 on the 6.x line.
- Fixed: 7.1.2-15 and 6.9.13-40.
- Condition: the advisory says the overflow matters on 32 bit systems and builds.
- Wrappers: the GitHub advisory also lists Magick.NET NuGet packages, fixed in 14.10.3, which bundle ImageMagick.
How to check if you're exposed
Check the ImageMagick version and the pointer size of your build:
magick -version
convert -version
file $(which magick)
Look for a 32 bit executable. For .NET projects, check the Magick.NET packages:
dotnet list package | grep Magick.NET
Also check container base images, since ImageMagick is often installed as a system package.
What to do now
- Upgrade to ImageMagick 7.1.2-15 or 6.9.13-40, or the distribution package that includes the fix.
- Update Magick.NET packages to 14.10.3 or later if you use them.
- Rebuild container images that include ImageMagick and redeploy.
- Restrict which image formats ImageMagick accepts with a policy file, and disable formats such as Sun raster that your service does not need.
- Run image conversion in a sandboxed process with limited memory and no network.
Why it matters
The record lists CWE-190, integer overflow, and CWE-122, heap based buffer overflow. A size calculation in the Sun decoder can wrap on a 32 bit build, so the code allocates too little memory and then writes past it.
The score is moderate because the issue is limited to 32 bit builds and needs a crafted image. Image libraries are still worth patching promptly because they process files from users. The record does not mark this CVE as exploited in the wild.
How to prioritise the fix
ImageMagick is often present without anyone choosing it: a base image, a web framework helper or a document tool pulls it in. Search container images and servers for it, not just application manifests.
Decide next whether the build is 32 bit. The advisory frames this issue around 32 bit builds, so a 64 bit fleet is lower priority, though you should still move to the fixed releases through your normal patch cycle. A policy file that disables formats you do not use is a cheap extra layer.
A dependency scan answers the first question, which is whether the package is present at all. Reachability analysis answers the second, which is whether your code calls the vulnerable path. You can start with the free scan at gold.safeguard.sh/scan and then read the Gold entry for this CVE to see affected ranges.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is my 64 bit server affected?
The advisory frames the out of bounds write for 32 bit builds. Still upgrade, because the fixed releases are the supported state.
What reduces exposure to image bugs generally?
A policy that allows only the formats you need, plus running conversion in an isolated, resource limited process.
Sources
Last reviewed: 19 October 2026.
