CVE-2026-25798
Published: 24 February 2026
Summary
CVE-2026-25798 is a medium-severity NULL Pointer Dereference (CWE-476) vulnerability in Imagemagick Imagemagick. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
NULL pointer dereference enables remote DoS via crafted image file against apps using the library (T1190 for public-facing exploitation and T1499.004 for application exploitation causing crash).
NVD Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted…
more
image file, resulting in denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Deeper analysisAI
CVE-2026-25798 is a NULL pointer dereference vulnerability (CWE-476) in the ClonePixelCacheRepository function of ImageMagick, a free and open-source software suite for editing and manipulating digital images. The flaw affects ImageMagick versions prior to 7.1.2-15 and 6.9.13-40, enabling a remote attacker to crash any application linked against the library by supplying a specially crafted image file, resulting in denial of service.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low attack complexity and no user interaction required, as reflected in its CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Exploitation causes affected applications to crash due to the null pointer dereference, disrupting availability without impacting confidentiality or integrity.
The official ImageMagick security advisory (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p863-5fgm-rgq4) confirms that versions 7.1.2-15 and 6.9.13-40 include patches to address the issue. Security practitioners should prioritize updating all linked applications to these fixed versions to mitigate the risk.
Details
- CWE(s)