7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25989

CVE-2026-25989: ImageMagick: Integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder

A crafted SVG file can cause a denial of service. An off-by-one boundary check (> instead of >=) that allows bypass the guard and reach an undefined (size_t) cast.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25989

CVE-2026-25989:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-OpenMP-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-x86	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-x86	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-x86	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-OpenMP-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-x86	nuget	< 14.10.3	14.10.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in a set of utility functions within ImageMagick responsible for converting double-precision floating-point numbers to various integer types. The core of the issue is an off-by-one error in the boundary checks of these functions. Specifically, they used a strict greater-than operator (>) to check if the input double exceeded the maximum value of the target integer type. This meant that if a double had a value exactly equal to the maximum integer value (e.g., (double)INT_MAX), the check would pass, but the subsequent type cast would result in an integer overflow, leading to undefined behavior and likely a crash (Denial of Service). This could be triggered by processing a specially crafted SVG file that contains such floating-point values. The patch addresses this by changing the comparison operator from > to >= in all affected casting functions, ensuring that values equal to the maximum are also correctly handled and clamped, thus preventing the overflow.

Vulnerable functions

CastDoubleToInt

MagickCore/image-private.h

The function performs a cast from a double to an integer. The boundary check used a '>' comparison, which allowed a value equal to MAGICK_INT_MAX to pass through, leading to an integer overflow upon casting. The patch corrects this by using '>='.

CastDoubleToPtrdiffT

MagickCore/image-private.h

This function has an off-by-one error in its boundary check when converting a double to ptrdiff_t. A value equal to MAGICK_PTRDIFF_MAX would bypass the check and cause an overflow. The fix changes the comparison from '>' to '>='.

CastDoubleToQuantumAny

MagickCore/image-private.h

The function is vulnerable to an integer overflow due to an incorrect boundary check. A double value equal to the maximum QuantumAny value would pass the check and lead to an overflow. The patch corrects the check to be inclusive by using '>='.

CastDoubleToSizeT

MagickCore/image-private.h

An integer overflow can occur in this function because the check to prevent it is off by one. A double equal to MAGICK_SIZE_MAX would not be caught, causing an overflow. The fix is to change the '>' to a '>='.

CastDoubleToSsizeT

MagickCore/image-private.h

This function is vulnerable to an integer overflow when converting a double to ssize_t. The boundary check was incorrect, allowing a value equal to MAGICK_SSIZE_MAX to cause an overflow. The patch corrects this by changing the comparison operator to '>='.

CastDoubleToUInt

MagickCore/image-private.h

The function contains an integer overflow vulnerability. The check against MAGICK_UINT_MAX used a '>' which is incorrect. A double with a value equal to MAGICK_UINT_MAX would cause an overflow. The patch fixes this by using '>='.

CastDoubleToUShort

MagickCore/image-private.h

This function is vulnerable to an integer overflow. A double value equal to MAGICK_USHORT_MAX would pass the boundary check due to the use of '>' instead of '>=', leading to an overflow on casting. The patch corrects this.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.