5.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25576

CVE-2026-25576: ImageMagick: Out of bounds read in multiple coders read raw pixel data

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in multiple raw image format handles. The vulnerability occurs when processing images with -extract dimensions larger than -size dimensions, causing out-of-bounds memory reads from a heap-allocated buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25576

CVE-2026-25576:

5.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-x86	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-x86	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-x86	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-x86	nuget	< 14.10.3	14.10.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a heap-based buffer over-read that exists in multiple functions responsible for reading raw pixel data for various image formats (BGR, CMYK, GRAY, RAW, RGB, and YCbCr). The core of the issue lies in the way ImageMagick handles image processing when the -extract dimension is larger than the -size dimension. In the vulnerable versions, the loop that iterates over the image's columns to read pixel data used the width from the -extract option (image->columns) as its boundary. However, the buffer (canvas_image) from which the data was being read was allocated based on the -size dimension. When a larger -extract width was provided, the loop would attempt to read past the end of the allocated canvas_image buffer, resulting in a heap buffer over-read. The patch addresses this by calculating the number of columns to read as the minimum of the -extract width and the canvas_image width. This ensures that the read operation remains within the bounds of the allocated buffer, thereby mitigating the vulnerability. The identified vulnerable functions are the Read*Image functions within their respective coder files, as these are the functions that contain the flawed loop logic.

Vulnerable functions

ReadBGRImage

coders/bgr.c

The function reads BGR image data. It was vulnerable to a heap buffer over-read because it used `image->columns` as the loop bound when reading pixel data from `canvas_image`. If `image->columns` (from `-extract` option) is larger than `canvas_image->columns` (from `-size` option), this would cause a read beyond the bounds of the allocated `canvas_image` buffer. The patch introduces a `columns` variable, which is the minimum of the two, to prevent this.

ReadCMYKImage

coders/cmyk.c

The function reads CMYK image data. It was vulnerable to a heap buffer over-read because it used `image->columns` as the loop bound when reading pixel data from `canvas_image`. If `image->columns` (from `-extract` option) is larger than `canvas_image->columns` (from `-size` option), this would cause a read beyond the bounds of the allocated `canvas_image` buffer. The patch introduces a `columns` variable, which is the minimum of the two, to prevent this.

ReadGRAYImage

coders/gray.c

The function reads grayscale image data. It was vulnerable to a heap buffer over-read because it used `image->columns` as the loop bound when reading pixel data from `canvas_image`. If `image->columns` (from `-extract` option) is larger than `canvas_image->columns` (from `-size` option), this would cause a read beyond the bounds of the allocated `canvas_image` buffer. The patch introduces a `columns` variable, which is the minimum of the two, to prevent this.

ReadRAWImage

coders/raw.c

The function reads raw image data. It was vulnerable to a heap buffer over-read because it used `image->columns` as the loop bound when reading pixel data from `canvas_image`. If `image->columns` (from `-extract` option) is larger than `canvas_image->columns` (from `-size` option), this would cause a read beyond the bounds of the allocated `canvas_image` buffer. The patch introduces a `columns` variable, which is the minimum of the two, to prevent this.

ReadRGBImage

coders/rgb.c

The function reads RGB image data. It was vulnerable to a heap buffer over-read because it used `image->columns` as the loop bound when reading pixel data from `canvas_image`. If `image->columns` (from `-extract` option) is larger than `canvas_image->columns` (from `-size` option), this would cause a read beyond the bounds of the allocated `canvas_image` buffer. The patch introduces a `columns` variable, which is the minimum of the two, to prevent this.

ReadRGB565Image

coders/rgb.c

The function reads RGB565 image data. It was vulnerable to a heap buffer over-read because it used `image->columns` as the loop bound when reading pixel data from `canvas_image`. If `image->columns` (from `-extract` option) is larger than `canvas_image->columns` (from `-size` option), this would cause a read beyond the bounds of the allocated `canvas_image` buffer. The patch introduces a `columns` variable, which is the minimum of the two, to prevent this.

ReadYCBCRImage

coders/ycbcr.c

The function reads YCbCr image data. It was vulnerable to a heap buffer over-read because it used `image->columns` as the loop bound when reading pixel data from `canvas_image`. If `image->columns` (from `-extract` option) is larger than `canvas_image->columns` (from `-size` option), this would cause a read beyond the bounds of the allocated `canvas_image` buffer. The patch introduces a `columns` variable, which is the minimum of the two, to prevent this.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.