CVE-2026-25797

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25797", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-05T19:58:01.640Z", "datePublished": "2026-02-24T01:01:22.025Z", "dateUpdated": "2026-02-26T15:13:42.512Z"}, "containers": {"cna": {"title": "ImageMagick vulnerable to Code injection via PostScript header in ps coders", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rw6c-xp26-225v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rw6c-xp26-225v"}], "affected": [{"vendor": "ImageMagick", "product": "ImageMagick", "versions": [{"version": ">= 7.0.0, < 7.1.2-15", "status": "affected"}, {"version": "< 6.9.13-40", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T01:01:22.025Z"}, "descriptions": [{"lang": "en", "value": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the ps coders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript header. An attacker can provide a malicous file and inject arbitrary PostScript code. When the resulting file is processed by a printer or a viewer (like Ghostscript), the injected code is interpreted and executed. The html encoder does not properly escape strings that are written to in the html document. An attacker can provide a malicious file and injection arbitrary html code. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}], "source": {"advisory": "GHSA-rw6c-xp26-225v", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T15:13:11.583896Z", "id": "CVE-2026-25797", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:13:42.512Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25797", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T15:13:11.583896Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:13:26.292Z"}}], "cna": {"title": "ImageMagick vulnerable to Code injection via PostScript header in ps coders", "source": {"advisory": "GHSA-rw6c-xp26-225v", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "ImageMagick", "product": "ImageMagick", "versions": [{"status": "affected", "version": ">= 7.0.0, < 7.1.2-15"}, {"status": "affected", "version": "< 6.9.13-40"}]}], "references": [{"url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rw6c-xp26-225v", "name": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rw6c-xp26-225v", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the ps coders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript header. An attacker can provide a malicous file and inject arbitrary PostScript code. When the resulting file is processed by a printer or a viewer (like Ghostscript), the injected code is interpreted and executed. The html encoder does not properly escape strings that are written to in the html document. An attacker can provide a malicious file and injection arbitrary html code. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T01:01:22.025Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25797", "state": "PUBLISHED", "dateUpdated": "2026-02-26T15:13:42.512Z", "dateReserved": "2026-02-05T19:58:01.640Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-24T01:01:22.025Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ImageMagick", "vendor": "ImageMagick", "versions": [{"status": "affected", "version": ">= 7.0.0, < 7.1.2-15"}, {"status": "affected", "version": "< 6.9.13-40"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*", "matchCriteriaId": "C6F44A65-1733-4752-AAD0-BCCC7BDBC877", "versionEndExcluding": "6.9.13-40", "vulnerable": true}, {"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*", "matchCriteriaId": "6AFFD439-1068-4B6F-AE01-724AC62CDCEA", "versionEndExcluding": "7.1.2-15", "versionStartIncluding": "7.0.0-0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the ps coders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript header. An attacker can provide a malicous file and inject arbitrary PostScript code. When the resulting file is processed by a printer or a viewer (like Ghostscript), the injected code is interpreted and executed. The html encoder does not properly escape strings that are written to in the html document. An attacker can provide a malicious file and injection arbitrary html code. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}, {"lang": "es", "value": "ImageMagick es un software libre y de c\u00f3digo abierto utilizado para editar y manipular im\u00e1genes digitales. Antes de las versiones 7.1.2-15 y 6.9.13-40, los codificadores ps, responsables de escribir archivos PostScript, no sanean la entrada antes de escribirla en la cabecera PostScript. Un atacante puede proporcionar un archivo malicioso e inyectar c\u00f3digo PostScript arbitrario. Cuando el archivo resultante es procesado por una impresora o un visor (como Ghostscript), el c\u00f3digo inyectado es interpretado y ejecutado. El codificador html no escapa correctamente las cadenas que se escriben en el documento html. Un atacante puede proporcionar un archivo malicioso e inyectar c\u00f3digo html arbitrario. Las versiones 7.1.2-15 y 6.9.13-40 contienen un parche."}], "id": "CVE-2026-25797", "lastModified": "2026-06-17T10:25:15.707", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25797", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T15:13:11.583896Z", "version": "2.0.3"}}]}, "published": "2026-02-24T01:16:14.450", "references": [{"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rw6c-xp26-225v"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "ImageMagick: ImageMagick: Arbitrary code execution via crafted PostScript files", "id": "2442106", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442106"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-94", "details": ["A flaw was found in ImageMagick, a software used for editing and manipulating digital images. This vulnerability allows an attacker to inject malicious code into PostScript files due to improper input sanitization in the PostScript coders. When a specially crafted file is processed by a printer or viewer, this injected code can be executed, potentially leading to arbitrary code execution. A similar issue exists in the HTML encoder, where improper escaping of strings could allow for arbitrary HTML injection."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, restrict ImageMagick's ability to process untrusted input files, especially when generating PostScript output. Alternatively, disable the PostScript (PS) coder in ImageMagick's policy configuration to prevent the creation of potentially malicious PostScript files. This can be achieved by editing the ImageMagick policy file, typically located at /etc/ImageMagick-X/policy.xml (where X is the ImageMagick version), and adding or modifying a policy entry to disable the 'PS' format. For example, add <policy domain=\"coder\" rights=\"none\" pattern=\"PS\" /> within the <policymap> tags. This action may impact applications that rely on ImageMagick's ability to write PostScript files. A service restart may be required for changes to take effect."}, "name": "CVE-2026-25797", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "ImageMagick", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "ImageMagick", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2026-02-24T01:01:22Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-25797\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-25797\nhttps://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rw6c-xp26-225v"], "statement": "This vulnerability has a MODERATE impact. ImageMagick's PostScript coders, as shipped in Red Hat Enterprise Linux 6 ELS and 7 ELS, are susceptible to arbitrary code injection. Processing a specially crafted file could lead to the execution of malicious PostScript code when rendered by a printer or viewer.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0.0,7.1.2-15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.9.13-40)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ImageMagick", "source": "cna", "vendor": "ImageMagick"}, "product": "imagemagick", "vendor": "imagemagick"}], "analysis": {"en": {"generated_at": "2026-04-17T16:02:15.542350+00:00", "value": {"mitigation_remediation": ["Upgrade ImageMagick to version 7.1.2\u201115 or later, or 6.9.13\u201140 or later, where the patch has been applied.", "If an immediate upgrade is not possible, restrict or disable the use of ps coders when handling untrusted image files, preventing malicious PostScript headers from being written.", "Run ImageMagick in a sandbox or restrict its execution environment so that any injected code cannot reach system resources or execute commands."], "summary": {"action": "Immediate Patch", "impact": "Remote code execution via injected PostScript code"}, "threat_synthesis": {"affected_systems": "All ImageMagick installations prior to versions 7.1.2\u201115 and 6.9.13\u201140 are affected. These versions write unfiltered input into the PostScript header, leaving the system vulnerable to malicious image files. The product is ImageMagick:ImageMagick, which may be used to convert images to PostScript on a variety of platforms.", "description_and_impact": "This vulnerability occurs in ImageMagick\u2019s PostScript writers; unsanitized input in the PostScript header allows an attacker to embed arbitrary PostScript commands. When the resulting PostScript file is processed by a printer or viewer, such as Ghostscript, the injected code is executed with the privileges of the ImageMagick process. The weakness is characterized as CWE\u201194 (Code Injection) and carries a CVSS score of 5.7, indicating a moderate severity.", "risk_and_exploitability": "The EPSS score is less than 1%, suggesting a low probability of exploitation, and the vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires possession of a crafted image file that will be processed by the ps coders; once the file is rendered by a PostScript interpreter, the attacker\u2019s code runs. If the ImageMagick process operates with elevated privileges, the impact could be particularly severe."}}}}, "created": "2026-02-24T09:54:08.112198+00:00", "updated": "2026-04-17T16:15:22.633607+00:00", "vendors": ["imagemagick", "imagemagick$PRODUCT$imagemagick"]}