medium5.3
CVE-2026-25970
ImageMagick Has Signed Integer Overflow in SIXEL Decoder, Leading to Memory Corruption
Impact
A signed integer overflow vulnerability in ImageMagick's SIXEL decoder allows an attacker to trigger memory corruption and denial of service when processing a maliciously crafted SIXEL image file. The vulnerability occurs during buffer reallocation operations where pointer arithmetic using signed 32-bit integers overflows. ``` AddressSanitizer:DEADLYSIGNAL ================================================================= ==143838==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 #0 0x7f379d5adb53 (/lib/x86_64-linux-gnu/libc.so.6+0xc4b53) ```
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Magick.NET-Q16-AnyCPU | < 14.10.3 | 14.10.3 |
| nuget | Magick.NET-Q16-HDRI-AnyCPU | < 14.10.3 | 14.10.3 |
| nuget | Magick.NET-Q16-HDRI-OpenMP-arm64 | < 14.10.3 | 14.10.3 |
| nuget | Magick.NET-Q16-HDRI-arm64 | < 14.10.3 | 14.10.3 |
| nuget | Magick.NET-Q16-HDRI-x64 | < 14.10.3 | 14.10.3 |
| nuget | Magick.NET-Q16-HDRI-x86 | < 14.10.3 | 14.10.3 |
| nuget | Magick.NET-Q16-OpenMP-arm64 | < 14.10.3 | 14.10.3 |
| nuget | Magick.NET-Q16-OpenMP-x64 | < 14.10.3 | 14.10.3 |
| nuget | Magick.NET-Q16-OpenMP-x86 | < 14.10.3 | 14.10.3 |
| nuget | Magick.NET-Q16-arm64 | < 14.10.3 | 14.10.3 |
| nuget | Magick.NET-Q16-x64 | < 14.10.3 | 14.10.3 |
| nuget | Magick.NET-Q16-x86 | < 14.10.3 | 14.10.3 |
| nuget | Magick.NET-Q16-HDRI-OpenMP-x64 | < 14.10.3 | 14.10.3 |
| nuget | Magick.NET-Q8-AnyCPU | < 14.10.3 | 14.10.3 |
| nuget | Magick.NET-Q8-OpenMP-arm64 | < 14.10.3 | 14.10.3 |
| nuget | Magick.NET-Q8-OpenMP-x64 | < 14.10.3 | 14.10.3 |
| nuget | Magick.NET-Q8-arm64 | < 14.10.3 | 14.10.3 |
| nuget | Magick.NET-Q8-x64 | < 14.10.3 | 14.10.3 |
| nuget | Magick.NET-Q8-x86 | < 14.10.3 | 14.10.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Imagemagick | Imagemagick | before 6.9.13-40 from 7.0.0-0 before 7.1.2-15 |