ImageMagick has integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder

Vulnerability

CVE-2026-25989 is an off-by-one boundary check in ImageMagick's SVG parsing code. The issue arises from using > instead of >= in a size comparison, allowing a crafted SVG file to bypass the intended guard and reach an undefined (size_t) cast [2]. This flaw affects versions prior to 7.1.2-15 and 6.9.13-40 [1].

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted SVG file to a vulnerable ImageMagick instance. No authentication or special network position is required; the attack can be triggered simply by processing the malicious file. This leads to a denial-of-service condition because the undefined cast causes undefined behavior, likely resulting in a crash [2].

Impact

The primary impact is denial of service: a remote unauthenticated attacker can cause ImageMagick to crash by submitting a malicious SVG file. There is no evidence of code execution or memory disclosure from the available information [2].

Mitigation

ImageMagick has patched the vulnerability in versions 7.1.2-15 and 6.9.13-40. Users should upgrade to these versions or later. The fix is available in the commit referenced [4]. Users are also encouraged to follow ImageMagick's security policy guidance [1].