CVE-2026-105825

Executive Summary

CVE-2026-105825 is a denial of service vulnerability in ImageMagick's handling of XMP profiles: a crafted XMP profile causes the process to terminate instead of raising an exception. ImageMagick versions before 6.9.13-55 (6.x) and before 7.1.2-30 (7.x) are affected. Any application, service, or pipeline that processes untrusted images with a vulnerable ImageMagick build can be crashed by an attacker-supplied image carrying a malicious XMP profile.

Technical Analysis

ImageMagick is a widely deployed image processing library and command-line toolkit used for converting, resizing, thumbnailing, and metadata parsing of images across web applications, content management systems, media pipelines, and enterprise document workflows. The vulnerability resides in the XMP profile parsing path. XMP (Extensible Metadata Platform) is an XML-based metadata standard (ISO 16684-1) commonly embedded in JPEG, TIFF, PNG, WebP, and PDF-adjacent media. ImageMagick parses embedded XMP profiles to expose image metadata to callers.

According to the NVD description, when processing a crafted XMP profile, the vulnerable code path "terminates the process instead of raising an exception." This is the defining characteristic of the flaw and maps cleanly to CWE-400 (Uncontrolled Resource Consumption) as classified by the CNA. The key implication is twofold:

1. Unhandled termination instead of recoverable error. A well-behaved parser encountering malformed or hostile input should raise a catchable error that the calling application can handle (log, skip the image, reject the upload). Here, the crafted profile causes an abnormal process termination. This means the failure is not gracefully contained. An image-processing worker, a long-lived service (e.g., a thumbnail daemon, a document conversion service, or any language binding invoking the library in-process), or an interpreter process (such as those invoking ImageMagick through PHP, Python, or Ruby bindings) can be killed outright.

2. Attacker-controlled input surfaces. The attack surface is any boundary where untrusted image bytes reach a vulnerable ImageMagick build: upload endpoints, media ingestion pipelines, email attachment scanning, document preview services, CMS thumbnail generation, and archive/media scanning tools that shell out to ImageMagick.

The NVD description does not disclose the specific function, parser routine, or malformed XML construct that triggers the termination, and no CNA title detail was provided. We therefore describe the flaw strictly at the vulnerability-class level: an input-handling defect in the XMP profile parser causes process death rather than a handled exception. No public proof-of-concept, Nuclei template, or exploit code is available in the provided data. The vulnerability is network-exploitable (AV:N) with no privileges (PR:N) and no user interaction (UI:N) required on the vulnerable component, making it trivially reachable in services that automatically process submitted images.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (uncontrolled resource consumption / unhandled termination in metadata parsing).

1. Reconnaissance / target identification. An attacker identifies services that accept or fetch images and process them server-side: file-upload endpoints, avatar/thumbnail generators, image converter APIs, CMS media uploads, e-signature and document-processing platforms, and any REST or webhook endpoint accepting base64 or multipart image data. Fingerprinting can target servers exposing ImageMagick-derived metadata behavior, version banners, or known tooling (e.g., services running on ImageMagick-backed libraries). Automated scanning across the internet can enumerate candidate services without authentication where endpoints are public.

2. Triggering the flaw class. The attacker crafts an image file (e.g., JPEG or TIFF) carrying an embedded XMP profile constructed to be malformed or otherwise hostile to the XMP parser in a way that reaches the vulnerable handling path. Because the flaw is triggered during profile handling — not during a privileged operation — no credentials or elevated rights are needed. The crafted image is submitted through any channel the target ingests (direct upload, URL fetch, email attachment, shared storage path).

3. Payload/execution method. The "payload" is the malicious image file itself, specifically its XMP profile section. When the target application hands the image to vulnerable ImageMagick for parsing or conversion, the XMP handling terminates the process instead of raising a catchable exception. The attacker does not need code execution or a memory-corruption primitive; the crash is a deterministic consequence of input handling. If the target application invokes ImageMagick in a persistent worker (in-process library call or a supervisor-managed daemon), the attacker can repeat submission to sustain the outage (crash-loop).

4. Post-exploitation impact. The impact is availability degradation, not confidentiality or integrity loss. Depending on architecture: a single request may kill a worker thread/process (brief throttling), or it may kill a critical shared service, causing an outage. If ImageMagick is embedded in-process (e.g., a language binding invoked by a web request handler that shares a process with other functions), the crash can take down the entire application process, converting a low-rated DoS into a broader service disruption. Repeated submissions can hold a service in a crash-restart loop, amplify resource waste, and, in severe deployments, cause cascading failures in dependent systems (queues backing up, retries amplifying load). Note that the NVD CVSS vector rates the availability impact as Low (A:L), implying the expected impact for a typical deployment is limited availability degradation rather than total catastrophic loss; however, blast radius scales with how the victim embeds ImageMagick.

Impact Assessment

CVSS v3.1: 5.3 (Medium) — AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The vector indicates the flaw is remotely reachable, requires no privileges or user interaction, affects only the vulnerable component (unchanged scope), and results in only partial/low availability impact with no confidentiality or integrity impact. Exploitation complexity is low and no public exploit is needed — the malformed image is itself the trigger.

Business impact:

• Service availability. Crash-loops in image, media, or document processing services can interrupt user-facing features (uploads, thumbnail generation, previews) and internal pipelines.
• Operational cost. Repeated restarts, queue backlogs, increased retry traffic, and incident response overhead.
• Blast radius proportionality. Low per-instance impact for hardened, worker-isolated deployments; high for monolithic applications or gateways where ImageMagick runs in the same process as other critical functionality.
• Supply-chain exposure. Because ImageMagick is embedded in countless third-party libraries, language bindings, and packaged applications, many downstream products inherit the flaw even if they do not advertise ImageMagick directly. Tracking affected versions across dependencies is the primary operational challenge.

No evidence of in-the-wild exploitation, CISA KEV listing, EPSS score, or threat-actor campaign is available in the provided data.

Detection Guidance

Detection focuses on (a) identifying vulnerable ImageMagick versions, (b) detecting abrupt crash/termination events in processes that parse images, and (c) detecting malicious or anomalous images carrying hostile XMP profiles.

Sigma Rule

title: ImageMagick Process Termination During Image/XMP Processing (CVE-2026-105825)
id: 8f3c2a91-image-magick-xmp-dos
status: experimental
description: Detects ImageMagick or image-processing processes terminating unexpectedly while handling image/XMP input, consistent with CVE-2026-105825 denial of service.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105825
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1499
logsource:
  category: process_creation
  product: windows
detection:
  selection_proc:
    Image|endswith:
      - '\magick.exe'
      - '\convert.exe'
      - '\identify.exe'
  selection_image_arg:
    CommandLine|contains:
      - '.jpg'
      - '.jpeg'
      - '.tif'
      - '.tiff'
      - '.png'
      - '.webp'
  selection_crash:
    # Correlate with application error 1000 / WER / non-zero exit
    ExitCode|gte: 1
  condition: selection_proc and selection_image_arg and selection_crash
level: medium

title: Linux ImageMagick Worker Killed While Parsing Image (CVE-2026-105825)
id: 1b77e0c4-image-magick-xmp-dos-lin
status: experimental
description: Detects ImageMagick processes killed by signal (SIGSEGV/SIGABRT) while processing image files containing XMP profiles.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105825
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'SYSCALL'
    exe|endswith:
      - '/magick'
      - '/convert'
      - '/identify'
    key: 'image_processing'
  crash:
    a0|contains: '.jpg'   # match on image arguments where logged
  condition: selection and crash
falsepositives:
  - Legitimate corrupt images causing benign crashes
level: low

YARA Rule

rule CVE_2026_105825_ImageMagick_Hostile_XMP
{
    meta:
        description = "Detects images carrying XMP profiles potentially crafted to trigger CVE-2026-105825 DoS in ImageMagick"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105825"
        tlp = "WHITE"

    strings:
        $xmp1 = "http://ns.adobe.com/xap/1.0/" ascii
        $xmp2 = "<x:xmpmeta" ascii nocase
        $xmp3 = "<?xpacket" ascii nocase
        $xmp4 = "xmpmeta" ascii nocase

    condition:
        (uint16(0) == 0xFFD8 or uint32(0) == 0x49492A00 or uint32(0) == 0x4D4D002A or
         uint32(0) == 0x89504E47)
        and ($xmp1 or $xmp2 or $xmp3 or $xmp4)
        and filesize < 20MB
}

Note: This rule identifies images containing embedded XMP metadata; it flags candidates for review rather than confirming exploitability, since the exact hostile XMP construct is not publicly documented.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105825 ImageMagick Malicious XMP Profile Upload Attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"<x:xmpmeta"; nocase; http.request_body; content:"http://ns.adobe.com/xap/1.0/"; nocase; http.request_body; content:"xpacket"; nocase; filestore; sid:2026105825; rev:1; metadata:affected_product ImageMagick, cve CVE-2026-105825, created_at 2026_01_01; classtype:attempted-dos; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105825;)

alert http any any -> any any (msg:"CVE-2026-105825 ImageMagick Image Upload with Embedded XMP"; flow:established,to_server; http.method; content:"POST"; file_data; content:"|FF D8 FF|"; file_data; content:"<x:xmpmeta"; nocase; file_data; depth:0; sid:2026105826; rev:1; metadata:cve CVE-2026-105825; classtype:attempted-dos; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105825;)

Elastic Detection

sequence by host.name with maxspan=5s
  [ process where event.type == "start" and
      process.name : ("magick", "magick.exe", "convert", "convert.exe", "identify", "identify.exe") ]
  [ process where event.type == "end" and
      process.exit_code != 0 and
      process.name : ("magick", "magick.exe", "convert", "convert.exe", "identify", "identify.exe") and
      (process.args : ("*.jpg", "*.jpeg", "*.tif", "*.tiff", "*.png", "*.webp")) ]

process where event.type == "end" and process.exit_code != 0 and
  process.name : ("magick", "convert", "identify") and
  process.args : ("*.jpg", "*.jpeg", "*.tif", "*.tiff", "*.png", "*.webp") and
  process.parent.name : ("php*", "python*", "ruby*", "node", "java", "httpd", "nginx", "apache*")

Splunk SPL Query

index=main (sourcetype=linux_audit OR sourcetype=WinEventLog:Security OR sourcetype=edr:process)
(process_name IN ("magick","magick.exe","convert","convert.exe","identify","identify.exe")
 OR Image IN ("*magick","*magick.exe","*convert","*identify"))
(image_path="*.jpg" OR image_path="*.jpeg" OR image_path="*.tif" OR image_path="*.tiff" OR image_path="*.png" OR image_path="*.webp"
 OR CommandLine="*.jpg" OR CommandLine="*.tif" OR CommandLine="*.png" OR CommandLine="*.webp")
(exit_code!=0 OR signal IN ("SIGSEGV","SIGABRT","SIGKILL") OR EventCode=1000)
| stats count min(_time) as first_seen max(_time) as last_seen values(exit_code) as exit_codes values(CommandLine) as cmd by host, process_name, user
| where count >= 3
| sort - count

Wazuh OSSEC Rule

<group name="imagemagick,cve-2026-105825,availability,">
  <rule id="105825" level="8">
    <if_sid>1002</if_sid>
    <field name="audit.exe">\/usr\/bin\/(magick|convert|identify)$</field>
    <field name="audit.key">image_processing</field>
    <description>CVE-2026-105825: ImageMagick process terminated abnormally while processing an image with XMP profile - possible DoS exploitation attempt.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_105825,denial_of_service,</group>
  </rule>

  <rule id="105826" level="10" frequency="5" timeframe="120">
    <if_matched_sid>105825</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-105825: Repeated ImageMagick crashes while processing images - sustained DoS / crash-loop detected.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source in the provided data).

1) Immediate mitigations (apply before/if upgrades cannot be deployed):

• Upgrade ImageMagick to 6.9.13-55 (6.x branch) or 7.1.2-30 (7.x branch) or later, per the version thresholds stated in the NVD description. This is the direct remediation. Verify the resolved version at runtime (e.g., magick -version / convert -version).
• Isolate image processing. Run image/text conversion in short-lived, sandboxed worker processes or containers so that a process termination in the converter does not take down the parent application. Use job supervision with restart limits to bound crash loops.
• Apply resource/behavior guards. Bound concurrency and restart rate for image-processing workers; enforce timeouts and input size limits; where supported, disable or restrict XMP/metadata parsing paths if they are not required for the workflow.
• Restrict reachability. Place upload and conversion endpoints behind authentication and rate limiting; reject unattributed/unverified image sources; scan attachments and fetched URLs before processing.
• Detect vulnerable builds. Inventory all embedded ImageMagick copies across applications, container images, language bindings, and third-party products; older versions transitively inherited from distributions are common.

2) Patch/upgrade steps:

• Identify exact current version for every deployment and dependency.
• Update to the fixed branch version (6.9.13-55 or 7.1.2-30, respectively) and rebuild/redeploy dependents so the patched shared library or binary is loaded.
• Where ImageMagick is a transitive dependency, obtain updated parent packages or pin a patched version.
• Re-test representative image-processing workflows after upgrade.
• Monitor NVD/CVE-2026-105825 and vendor channels for an official advisory, since no vendor patch source is currently tracked (confidence 0/4).

3) Long-term hardening:

• Treat image/metadata parsing as untrusted-input handling: run converters under least privilege, with seccomp/AppArmor/SELinux confinement and no network access.
• Add fuzzing of XMP and metadata parsers in CI to surface parser-termination defects before release.
• Adopt SBOM-driven dependency tracking to detect and remediate embedded ImageMagick versions across the estate.
• Alert on unexplained image-processor restarts and correlate them with upload activity to catch exploitation attempts.

References

• NVD — CVE-2026-105825: https://nvd.nist.gov/vuln/detail/CVE-2026-105825
• CWE-400 — Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• ImageMagick official site / releases (version verification): https://imagemagick.org/
• CISA Known Exploited Vulnerabilities Catalog (not currently listing this CVE — verify status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, threat-actor campaign, or in-the-wild exploitation evidence is available in the provided intelligence for CVE-2026-105825. EPSS has not yet been scored by FIRST.org; no EPSS value is asserted here.