ImageMagick stack buffer overflow (msl.c) before 7.1.2-15/6.9.13-40
CVE-2026-25968 Published on February 24, 2026
ImageMagick has MSL attribute stack buffer overflow that leads to out of bounds write.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Vulnerability Analysis
CVE-2026-25968 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and a high impact on availability.
Weakness Type
What is a Stack Overflow Vulnerability?
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CVE-2026-25968 has been classified to as a Stack Overflow vulnerability or weakness.
Products Associated with CVE-2026-25968
stack.watch emails you whenever new vulnerabilities are published in ImageMagick or Canonical Ubuntu Linux. Just hit a watch button to start following.
Affected Versions
ImageMagick:- Version >= 7.0.0, < 7.1.2-15 is affected.
- Version < 6.9.13-40 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.