CVE-2026-25968: ImageMagick: MSL attribute stack buffer overflow leads to out of bounds write.

March 12, 2026

A stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption.

=================================================================
==278522==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffdb8c76984 at pc 0x55a4bf16f507 bp 0x7ffdb8c75bc0 sp 0x7ffdb8c75bb0
WRITE of size 1 at 0x7ffdb8c76984 thread T0

References

github.com/ImageMagick/ImageMagick
github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3mwp-xqp2-q6ph
github.com/advisories/GHSA-3mwp-xqp2-q6ph
github.com/dlemstra/Magick.NET/releases/tag/14.10.3
nvd.nist.gov/vuln/detail/CVE-2026-25968

Code Behaviors & Features

Detect and mitigate CVE-2026-25968 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →