CVE-2026-25797

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-15 ImageMagick versions prior to 6.9.13-40

Description ImageMagick is software used for editing and manipulating digital images. The ps coders, which handle PostScript files, do not properly sanitize input before including it in the PostScript header. This allows an attacker to inject arbitrary PostScript code through a malicious file. When a printer or viewer, such as Ghostscript, processes the resulting file, the injected code is executed. Additionally, the html encoder does not correctly escape strings written to an html document, enabling an attacker to inject arbitrary html code through a malicious file.

Recommendations Update to ImageMagick version 7.1.2-15 or later. Update to ImageMagick version 6.9.13-40 or later.