~ / search / GHSA-vhqj-f5cj-9x8h

GHSA-vhqj-f5cj-9x8h

ImageMagick has heap-buffer-overflow via signed integer overflow in WriteUHDRImage when writing UHDR images with large dimensions

Source: GitHub Advisory Database (reviewed) High CVE-2026-25794

Packages

EcosystemPackageAffectedFixed in
NuGet Magick.NET-Q16-AnyCPU < 14.10.3 14.10.3
NuGet Magick.NET-Q16-HDRI-AnyCPU < 14.10.3 14.10.3
NuGet Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.10.3 14.10.3
NuGet Magick.NET-Q16-HDRI-OpenMP-x64 < 14.10.3 14.10.3
NuGet Magick.NET-Q16-HDRI-arm64 < 14.10.3 14.10.3
NuGet Magick.NET-Q16-HDRI-x64 < 14.10.3 14.10.3
NuGet Magick.NET-Q16-HDRI-x86 < 14.10.3 14.10.3
NuGet Magick.NET-Q16-OpenMP-arm64 < 14.10.3 14.10.3
NuGet Magick.NET-Q16-OpenMP-x64 < 14.10.3 14.10.3
NuGet Magick.NET-Q16-OpenMP-x86 < 14.10.3 14.10.3
NuGet Magick.NET-Q16-arm64 < 14.10.3 14.10.3
NuGet Magick.NET-Q16-x64 < 14.10.3 14.10.3
NuGet Magick.NET-Q16-x86 < 14.10.3 14.10.3
NuGet Magick.NET-Q8-AnyCPU < 14.10.3 14.10.3
NuGet Magick.NET-Q8-OpenMP-arm64 < 14.10.3 14.10.3
NuGet Magick.NET-Q8-OpenMP-x64 < 14.10.3 14.10.3
NuGet Magick.NET-Q8-arm64 < 14.10.3 14.10.3
NuGet Magick.NET-Q8-x64 < 14.10.3 14.10.3
NuGet Magick.NET-Q8-x86 < 14.10.3 14.10.3

Details

As written in the advisory (Markdown source, shown as plain text).

`WriteUHDRImage` in `coders/uhdr.c` uses `int` arithmetic to compute the pixel buffer size. When image dimensions are large, the multiplication overflows 32-bit `int`, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out of bounds heap write. ``` ==1575126==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fc382ef3820 at pc 0x5560d31f229f bp 0x7ffe865f9530 sp 0x7ffe865f9520 WRITE of size 8 at 0x7fc382ef3820 thread T0 #0 0x5560d31f229e in WriteUHDRImage coders/uhdr.c:807 ```

References

External links from the advisory. They lead to third-party sites.