CVE-2026-25795
Published: 24 February 2026
Summary
CVE-2026-25795 is a medium-severity NULL Pointer Dereference (CWE-476) vulnerability in Imagemagick Imagemagick. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 5.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
NULL pointer dereference in ImageMagick enables remote unauthenticated crash/DoS via crafted input to ReadSFWImage, directly mapping to application exploitation for endpoint denial of service.
NVD Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer…
more
dereference and crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Deeper analysisAI
CVE-2026-25795 is a NULL pointer dereference vulnerability in ImageMagick, a free and open-source software suite for editing and manipulating digital images. The issue resides in the `ReadSFWImage()` function within `coders/sfw.c`, where temporary file creation failure leads to the premature destruction of the `read_info` structure before its `filename` member is accessed, resulting in a crash. This affects ImageMagick versions prior to 7.1.2-15 and 6.9.13-40, with a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and is classified under CWE-476 (NULL Pointer Dereference).
The vulnerability can be exploited remotely by unauthenticated attackers with network access, requiring low complexity and no user interaction. Successful exploitation triggers a denial-of-service condition through application crash, impacting availability but without effects on confidentiality or integrity.
ImageMagick versions 7.1.2-15 and 6.9.13-40 include patches addressing the issue. Additional details are available in the GitHub Security Advisory at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p33r-fqw2-rqmm.
Details
- CWE(s)