Cyber Posture

CVE-2026-25795

Medium

Published: 24 February 2026

Published
24 February 2026
Modified
24 February 2026
KEV Added
Patch
CVSS Score 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.0002 5.8th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-25795 is a medium-severity NULL Pointer Dereference (CWE-476) vulnerability in Imagemagick Imagemagick. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 5.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Application or System Exploitation (T1499.004).
Threat & Defense Details

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

NULL pointer dereference in ImageMagick enables remote unauthenticated crash/DoS via crafted input to ReadSFWImage, directly mapping to application exploitation for endpoint denial of service.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer…

more

dereference and crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

Deeper analysisAI

CVE-2026-25795 is a NULL pointer dereference vulnerability in ImageMagick, a free and open-source software suite for editing and manipulating digital images. The issue resides in the `ReadSFWImage()` function within `coders/sfw.c`, where temporary file creation failure leads to the premature destruction of the `read_info` structure before its `filename` member is accessed, resulting in a crash. This affects ImageMagick versions prior to 7.1.2-15 and 6.9.13-40, with a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and is classified under CWE-476 (NULL Pointer Dereference).

The vulnerability can be exploited remotely by unauthenticated attackers with network access, requiring low complexity and no user interaction. Successful exploitation triggers a denial-of-service condition through application crash, impacting availability but without effects on confidentiality or integrity.

ImageMagick versions 7.1.2-15 and 6.9.13-40 include patches addressing the issue. Additional details are available in the GitHub Security Advisory at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p33r-fqw2-rqmm.

Details

CWE(s)

Affected Products

imagemagick
imagemagick
≤ 6.9.13-40 · 7.0.0-0 — 7.1.2-15

CVEs Like This One

CVE-2026-25798Same product: Imagemagick Imagemagick
CVE-2026-30883Same product: Imagemagick Imagemagick
CVE-2026-26066Same product: Imagemagick Imagemagick
CVE-2026-25799Same product: Imagemagick Imagemagick
CVE-2026-22770Same product: Imagemagick Imagemagick
CVE-2026-30931Same product: Imagemagick Imagemagick
CVE-2026-25989Same product: Imagemagick Imagemagick
CVE-2026-26283Same product: Imagemagick Imagemagick
CVE-2026-25971Same product: Imagemagick Imagemagick
CVE-2026-25796Same product: Imagemagick Imagemagick

References