6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25898

CVE-2026-25898: Imagemagick Has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer

The UIL and XPM image encoder do not validate the pixel index value returned by GetPixelIndex() before using it as an array subscript. In HDRI builds, Quantum is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash.

READ of size 1 at 0x55a8823a776e thread T0
    #0 0x55a880d01e85 in WriteUILImage coders/uil.c:355

READ of size 1 at 0x55fa1c04c66e thread T0
    #0 0x55fa1a9ee415 in WriteXPMImage coders/xpm.c:1135

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25898

CVE-2026-25898:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-OpenMP-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-x86	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-x86	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-OpenMP-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-x86	nuget	< 14.10.3	14.10.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an out-of-bounds read in ImageMagick's UIL and XPM image encoders. It occurs when processing images in High Dynamic Range Imaging (HDRI) mode, where pixel quantum values are floating-point numbers. The GetPixelIndex() function can return a negative index value for certain crafted images.

The WriteUILImage function in coders/uil.c and the WriteXPMImage function in coders/xpm.c both use the index returned by GetPixelIndex() to access an array without first validating that the index is non-negative. This leads to a global buffer overflow (out-of-bounds read).

The analysis of the commit c9c87dbaba56bf82aebd3392e11f0ffd93709b12 confirms the vulnerability in WriteUILImage and shows the fix, which is to add a check to ensure the index is not negative.

Although the patch for WriteXPMImage was not provided in the commit details, the vulnerability description and the provided stack trace (READ of size 1 at ... in WriteXPMImage coders/xpm.c:1135) are strong evidence that WriteXPMImage is also vulnerable due to the same underlying issue.

An attacker can exploit this by crafting a malicious image file that, when converted to the UIL or XPM format by a vulnerable version of ImageMagick, will trigger the out-of-bounds read. This can lead to a crash of the application or disclosure of sensitive information from the process memory.

The identified vulnerable functions are the ones that would appear in a profiler or stack trace during the exploitation of this vulnerability.

Vulnerable functions

WriteUILImage

coders/uil.c

The function `WriteUILImage` is vulnerable to an out-of-bounds read. It uses the value returned by `GetPixelIndex()` as an array index `k` without validating if it is negative. In HDRI builds, `GetPixelIndex()` can return a negative value, leading to a read from an invalid memory location. The patch mitigates this by adding a check to ensure `k` is non-negative before it's used as an index.

WriteXPMImage

coders/xpm.c

The vulnerability description provides a stack trace that explicitly shows an out-of-bounds read within the `WriteXPMImage` function at `coders/xpm.c:1135`. This indicates that, similar to `WriteUILImage`, this function uses the return value of `GetPixelIndex()` as an array index without proper validation, making it vulnerable to a buffer over-read when processing a crafted image with negative pixel indices.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.