CVE-2026-25985

Red Hat statement

This issue is classified as High severity by Red Hat Product Security. A remote attacker can craft an SVG image that, when processed by ImageMagick, induces extremely large memory allocation requests, leading to process failure or termination. The attack complexity is low and does not require any privileges or user interaction. While confidentiality and integrity are not directly impacted, the availability of services that parse or manipulate untrusted SVG images could be significantly disrupted over network, justifying a High severity rating. ``` It is important to note that ImageMagick has been removed from Red Hat Enterprise Linux 8 and later releases. Therefore, current supported RHEL 8 and newer systems are not affected by this issue unless ImageMagick is installed from third-party or custom repositories. For additional information, refer to https://access.redhat.com/solutions/4437561. ```

Red Hat mitigation

To mitigate this vulnerability, avoid processing untrusted or unverified SVG image files with ImageMagick. When ImageMagick must process SVG files from untrusted sources, consider running the application in a sandboxed environment to limit potential resource exhaustion impacts.