Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-brv4-dckz-jbf5
Vulnerability ID VCID-brv4-dckz-jbf5
Aliases CVE-2026-25989
GHSA-7355-pwx2-pm84
Summary ImageMagick: Integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder A crafted SVG file can cause a denial of service. An off-by-one boundary check (`>` instead of `>=`) that allows bypass the guard and reach an undefined `(size_t)` cast.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-190 Integer Overflow or Wraparound
CWE-681 Incorrect Conversion between Numeric Types
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-193 Off-by-one Error
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25989.json
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2026-25989
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-7355-pwx2-pm84
cvssv3.1 7.5 https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3
generic_textual HIGH https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3
cvssv3.1 7.5 https://github.com/ImageMagick/ImageMagick
generic_textual HIGH https://github.com/ImageMagick/ImageMagick
cvssv3.1 7.5 https://github.com/ImageMagick/ImageMagick/commit/5a545ab9d6c3d12a6a76cfed32b87df096729d95
generic_textual HIGH https://github.com/ImageMagick/ImageMagick/commit/5a545ab9d6c3d12a6a76cfed32b87df096729d95
cvssv3.1 7.5 https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84
cvssv3.1_qr HIGH https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84
generic_textual HIGH https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84
ssvc Track https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2026-25989
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-25989
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25989.json
https://api.first.org/data/v1/epss?cve=CVE-2026-25989
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3
https://github.com/ImageMagick/ImageMagick
https://github.com/ImageMagick/ImageMagick/commit/5a545ab9d6c3d12a6a76cfed32b87df096729d95
2442136 https://bugzilla.redhat.com/show_bug.cgi?id=2442136
CVE-2026-25989 https://nvd.nist.gov/vuln/detail/CVE-2026-25989
GHSA-7355-pwx2-pm84 https://github.com/advisories/GHSA-7355-pwx2-pm84
GHSA-7355-pwx2-pm84 https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25989.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/ImageMagick/ImageMagick
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/ImageMagick/ImageMagick/commit/5a545ab9d6c3d12a6a76cfed32b87df096729d95
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:08:53Z/ Found at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2026-25989
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.05984
EPSS Score 0.0002
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T21:06:48.284083+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/nuget/magick.net-q8-x64/CVE-2026-25989.yml 38.6.0