CVE-2026-25797
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the ps coders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript header. An attacker can provide a malicous file and inject arbitrary PostScript code. When the resulting file is processed by a printer or a viewer (like Ghostscript), the injected code is interpreted and executed. The html encoder does not properly escape strings that are written to in the html document. An attacker can provide a malicious file and injection arbitrary html code. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceImageMagick versions prior to 7.1.2-15 and 6.9.13-40 contain input sanitization failures in two output encoders. The PostScript (PS) coder fails to sanitize input before writing to the PostScript header, allowing arbitrary PostScript code injection that executes when the file is processed by Ghostscript or similar viewers. Additionally, the HTML encoder does not properly escape strings written to HTML documents, enabling HTML injection. Both vulnerabilities are exploitable via maliciously crafted image files.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 6.9.13-40>= 7.0.0-0, < 7.1.2-15CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Local
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Determine installed ImageMagick versionRun 'convert -version' or 'magick -version' to see the exact version number. Compare against the affected ranges: versions below 6.9.13-40, or 7.0.0-0 up to 7.1.2-15.Affected if The installed version falls within < 6.9.13-40 or >= 7.0.0-0, < 7.1.2-15.
-
Locate ImageMagick policy configurationCheck for policy.xml file, typically in /etc/ImageMagick/ or /usr/etc/. This file controls which coders are enabled or disabled.Affected if The policy.xml exists and does not restrict or disable the PS and HTML coders.
-
Verify PS coder is enabledSearch the policy.xml for <coder name="ps" or <coder name="ps2" entries. If present, ensure the rights attribute is set to 'none' or the coder is explicitly disabled. If not found, the coder may be enabled by default.Affected if The PS coder is not explicitly disabled in the policy configuration.
-
Verify HTML coder is enabledSearch the policy.xml for <coder name="html" entries. Check if rights attribute is set to 'none' or the coder is explicitly disabled. If not found, the coder may be enabled by default.Affected if The HTML coder is not explicitly disabled in the policy configuration.
-
Check for direct PS/HTML output usageReview application code or scripts that invoke ImageMagick for output formats. Look for commands using '-format ps', '-format ps2', or '-format html' with convert/magick utilities.Affected if The PS or HTML output encoders are invoked to process untrusted image files.
You are affected if your ImageMagick version is below 7.1.2-15 (for 7.x) or below 6.9.13-40 (for 6.x) AND the PS or HTML coders are enabled and can process untrusted input files.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped6.9.13-407.1.2-15
Upgrade ImageMagick to version 7.1.2-15 or 6.9.13-40 or later. Until patching is feasible, disable or restrict processing of untrusted image files through the PS and HTML coders, and consider running Ghostscript in restricted/sandboxed mode when ImageMagick output is printed or viewed.
Upgrade to ImageMagick 7.1.2-15 (if using v7) or 6.9.13-40 (if using v6)
- 1. Identify current ImageMagick version by running 'convert --version' or 'magick --version'
- 2. For RHEL/CentOS/Fedora systems: run 'sudo dnf update ImageMagick' or 'sudo yum update ImageMagick' to get the latest available version
- 3. For Debian/Ubuntu systems: run 'sudo apt-get update' followed by 'sudo apt-get install --only-upgrade imagemagick'
- 4. For macOS via Homebrew: run 'brew upgrade imagemagick'
- 5. For source compilation: download ImageMagick 7.1.2-15 (for v7) or 6.9.13-40 (for v6) from https://imagemagick.org/archive/ and compile with standard options
- 6. Verify the fix by running 'convert --version' and confirming the version number matches or exceeds the fixed release
- 7. Test any ImageMagick-based workflows with PostScript files to ensure normal operation
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation3.0 h
- Implementation6.0 h
- Testing3.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,984.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-25797 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-25797 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data