CVE-2026-25797

A flaw was found in ImageMagick, a software used for editing and manipulating digital images. This vulnerability allows an attacker to inject malicious code into PostScript files due to improper input sanitization in the PostScript coders. When a specially crafted file is processed by a printer or viewer, this injected code can be executed, potentially leading to arbitrary code execution. A similar issue exists in the HTML encoder, where improper escaping of strings could allow for arbitrary HTML injection.

This vulnerability has a MODERATE impact. ImageMagick's PostScript coders, as shipped in Red Hat Enterprise Linux 6 ELS and 7 ELS, are susceptible to arbitrary code injection. Processing a specially crafted file could lead to the execution of malicious PostScript code when rendered by a printer or viewer.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, restrict ImageMagick's ability to process untrusted input files, especially when generating PostScript output. Alternatively, disable the PostScript (PS) coder in ImageMagick's policy configuration to prevent the creation of potentially malicious PostScript files. This can be achieved by editing the ImageMagick policy file, typically located at /etc/ImageMagick-X/policy.xml (where X is the ImageMagick version), and adding or modifying a policy entry to disable the 'PS' format. For example, add <policy domain="coder" rights="none" pattern="PS" /> within the <policymap> tags. This action may impact applications that rely on ImageMagick's ability to write PostScript files. A service restart may be required for changes to take effect.