CVE-2026-25898 is a medium severity flaw (CVSS 6.5) in ImageMagick, where the UIL and XPM encoders read past an array. CWE-125 describes the weakness, an out-of-bounds read that can leak memory or crash the process. Upgrade to ImageMagick 7.1.2-15 or 6.9.13-40, the patched releases. It is not listed in CISA's KEV catalog.
What's affected
- ImageMagick 7.x before 7.1.2-15
- ImageMagick 6.9.x before 6.9.13-40
- Fixed in 7.1.2-15 and 6.9.13-40
The advisory lists no workaround. Upgrading is the remedy it names. Many other products embed ImageMagick through libraries such as Magick++, so the version of the command line tool on your laptop may not be the one that matters.
How to check if you're exposed
Check the version of the tool on each host that converts images:
magick -version
convert -version
The second command covers older 6.x installs. Then look for bundled copies: language bindings, container images and application packages that ship their own ImageMagick. A system package manager only reports what it installed itself.
Safeguard has a free in-browser dependency scan at https://gold.safeguard.sh/scan that reads a manifest or lockfile and flags known vulnerable packages, with no repository access needed. For container images, check the package list of the image rather than the host.
What to do now
- Upgrade to 7.1.2-15 or 6.9.13-40 or later, through your distribution package or by rebuilding from the project's release.
- Rebuild and redeploy container images and applications that bundle ImageMagick, then confirm the version inside the running image.
- Find the services that accept uploads from users or fetch images from outside and note which ones call ImageMagick.
- Where upgrading must wait, limit which formats ImageMagick will decode using its policy file, which is a general hardening step and not something this advisory prescribes.
- Keep ImageMagick in your software inventory so the next advisory is a lookup, not a search.
Why it matters
The cause is a missing check. The UIL and XPM encoders take the value returned by GetPixelIndex() and use it as an array subscript without validating it. In HDRI builds the Quantum type is floating point, so that index can be negative. A crafted image with negative pixel index values then triggers a global buffer over-read during conversion. The advisory says the result is information disclosure or a process crash.
The score is moderate because the read is limited and the impact is partial, with low confidentiality and availability effects and none on integrity. The attack needs no privileges, which is why it still deserves a quick upgrade on services that convert untrusted images.
The class matters for triage. Image decoders run on bytes you do not control, so any memory safety bug in a coder is reachable wherever your product accepts an image. Reachability analysis helps here: it shows whether your code actually calls the vulnerable coder, so you can order the upgrades by real exposure instead of by score alone.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this one exploited in the wild?
The record does not flag it as a CISA KEV entry, and the advisory we read does not report exploitation. Treat it as a patch-soon item, not an incident.
Does my build matter, HDRI or not?
The advisory ties the negative index to HDRI builds, where Quantum is floating point. Do not rely on that to skip the upgrade, because the fixed releases cover all builds and you may not know how a bundled copy was compiled.
Sources
Last reviewed: 19 October 2026.
