7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25985

CVE-2026-25985: ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder

A crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort.

Found via AFL++ fuzzing with afl-clang-lto instrumentation and AddressSanitizer.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25985

CVE-2026-25985:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-OpenMP-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-x86	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-x86	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-x86	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-OpenMP-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-x86	nuget	< 14.10.3	14.10.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial-of-service caused by excessive memory allocation in ImageMagick's SVG decoder. The provided commit 1a51eb9af00c36724660e294520878fd1f13e312 clearly shows the fix for this issue. The changes are located in the MagickCore/draw.c file, specifically within the CheckPrimitiveExtent and TraceBezier functions. In both functions, the code was modified to replace checks against MAGICK_SSIZE_MAX with checks against a value returned by GetMaxMemoryRequest(). This change indicates that the original code was susceptible to allocating an extremely large amount of memory if a specially crafted SVG file was processed. The functions CheckPrimitiveExtent and TraceBezier are directly involved in processing the SVG data and calculating memory requirements. Therefore, these are the vulnerable functions that would appear in a runtime profile when the vulnerability is triggered.

Vulnerable functions

CheckPrimitiveExtent

MagickCore/draw.c

The function `CheckPrimitiveExtent` is responsible for checking if a primitive's extent is within the allowed memory limits. Before the patch, it compared the calculated `extent` with `MAGICK_SSIZE_MAX`, which is a very large value, effectively allowing for an almost unlimited memory allocation. A malicious SVG file could exploit this by providing values that result in a huge `extent`, leading to a denial-of-service attack. The patch replaces `MAGICK_SSIZE_MAX` with `GetMaxMemoryRequest()`, which enforces a much stricter and safer memory limit.

TraceBezier

MagickCore/draw.c

The `TraceBezier` function, which is used to render Bezier curves from an SVG file, was also vulnerable to excessive memory allocation. It calculated a value `alpha` based on the coordinates in the SVG file and checked it against `MAGICK_SSIZE_MAX`. This allowed a crafted SVG with large coordinate values to cause an enormous memory allocation request. The patch mitigates this by replacing `MAGICK_SSIZE_MAX` with `GetMaxMemoryRequest()` and adding an additional check for the `quantum` variable to ensure it does not exceed the maximum allowed memory request before allocating memory.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.