ImageMagick has heap-buffer-overflow via signed integer overflow in `WriteUHDRImage` when writing UHDR images with large dimensions

Vulnerability

CVE-2026-25794 is an integer overflow vulnerability in ImageMagick's WriteUHDRImage function in coders/uhdr.c. The function uses int arithmetic to compute the pixel buffer size. When image dimensions are large, the multiplication overflows a 32-bit int, resulting in an undersized heap allocation. Subsequent writes to this buffer cause an out-of-bounds heap write [1][2].

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted image with large dimensions. No authentication is required if the application processes untrusted images via ImageMagick. The overflow silently produces a small buffer, and then data is written beyond its bounds, leading to memory corruption [2].

Impact

Successful exploitation can crash the process or potentially lead to arbitrary code execution in the context of the affected application. The vulnerability is classified as a heap buffer overflow with high severity [2].

Mitigation

The issue is fixed in ImageMagick version 7.1.2-15 [2]. The commit (ffe589df5ff8ce1433daa4ccb0d2a9fadfbe30ed) adds a check to reject images with dimensions that would cause overflow [4]. The Magick.NET library also includes this fix in version 14.10.3 [3]. As a workaround, administrators can enforce security policies that limit image dimensions to prevent exploitation [1].