ImageMagick: Code Injection via PostScript header in ps coders
The ps encoders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript header. An attacker can provide a malicious file and inject arbitrary PostScript code. When the resulting file is processed by a printer or a viewer (like Ghostscript), the injected code is interpreted and executed. The html encoder does not properly escape strings that are written to in the html document. An attacker can provide a malicious file and injection arbitrary html code.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-25797US | medium5.3 | — | ||
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the ps coders, responsible for writing Post… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/ImageMagick/ImageMagickPACKAGE
- https://github.com/ImageMagick/ImageMagick/commit/26088a83d71e9daa203d54a56fe3c31f3f85463dWEB
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rw6c-xp26-225vWEB
- https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-25797ADVISORY
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan