CVE-2026-25985 — Memory allocation with excessive without limits in the internal SVG decoder

Description (CNA)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

Affected (CNA)

Vendor / product	Versions
ImageMagick / ImageMagick	affected >= 7.0.0, < 7.1.2-15; affected < 6.9.13-40

CWE

CWE-770, CWE-789

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A memory exhaustion vulnerability has been identified in ImageMagick when processing specially crafted SVG image files. In vulnerable versions, a maliciously crafted SVG element may trigger an excessively large internal memory allocation (on the order of hundreds of gigabytes), causing the ImageMagick process to consume all available memory and abort. An application that reads, identifies, or converts such an SVG image may be affected when the file is passed to ImageMagick’s API or command-line tools.