CVE-2026-25986
Heap Buffer Overflow in ImageMagick YUV Image Processing
Publication date: 2026-02-24
Last updated on: 2026-02-25
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| imagemagick | imagemagick | to 6.9.13-40 (exc) |
| imagemagick | imagemagick | From 7.0.0-0 (inc) to 7.1.2-15 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-25986 is a moderate severity heap buffer overflow vulnerability in the ImageMagick software. It occurs in the ReadYUVImage() function when processing malicious YUV 4:2:2 (NoInterlace) images. Specifically, the pixel-pair loop writes one pixel beyond the allocated row buffer, causing a heap buffer overflow write.
This vulnerability affects ImageMagick versions prior to 7.1.2-15 and 6.9.13-40 and has been patched in these versions.
The out-of-bounds write can lead to memory corruption and potentially allows remote attackers to cause a denial of service or possibly execute arbitrary code by supplying crafted images.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing remote attackers to cause a denial of service (DoS) on systems using vulnerable versions of ImageMagick when processing malicious YUV 4:2:2 images.
There is also a potential risk of arbitrary code execution, which could lead to further compromise of the affected system.
However, the vulnerability does not impact confidentiality or integrity of data, only availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability occurs when processing malicious YUV 4:2:2 (NoInterlace) images with vulnerable versions of ImageMagick prior to 7.1.2-15 and 6.9.13-40. Detection involves identifying if your system is running an affected version of ImageMagick and monitoring for attempts to process suspicious YUV 4:2:2 images.
Since the vulnerability is triggered by crafted image files, you can detect potential exploitation attempts by scanning logs for errors or crashes related to ImageMagick when handling YUV 4:2:2 images.
Commands to check the installed ImageMagick version include:
- magick -version
- convert -version
To detect suspicious files, you might search for files with YUV 4:2:2 format or monitor network traffic for such image uploads, but no specific detection commands are provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade ImageMagick to a patched version. Versions 7.1.2-15 and 6.9.13-40 contain fixes for this heap buffer overflow vulnerability.
If upgrading immediately is not possible, consider restricting or disabling processing of untrusted YUV 4:2:2 (NoInterlace) images to prevent exploitation.
Additionally, monitor your systems for crashes or unusual behavior in ImageMagick processes that might indicate exploitation attempts.