CVE-2026-25799
Published: 24 February 2026
Summary
CVE-2026-25799 is a medium-severity Divide By Zero (CWE-369) vulnerability in Imagemagick Imagemagick. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 5.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Division-by-zero crash on crafted image load directly enables remote application DoS via software vulnerability exploitation (T1499.004).
NVD Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during…
more
image loading, resulting in a reliable denial-of-service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Deeper analysisAI
CVE-2026-25799 is a logic error in the YUV sampling factor validation within ImageMagick, a free and open-source software suite for editing and manipulating digital images. In versions prior to 7.1.2-15 (for the 7.x branch) and 6.9.13-40 (for the 6.x branch), an invalid sampling factor can bypass validation checks, leading to a division-by-zero error during image loading. This vulnerability, classified under CWE-369 (Divide by Zero), carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), indicating medium severity primarily due to its impact on availability.
The vulnerability can be exploited remotely by unauthenticated attackers with network access, requiring low complexity and no user interaction. By crafting a malicious image file with an invalid YUV sampling factor and inducing a targeted ImageMagick instance to load it—such as through a web application or image processing pipeline—the attacker triggers a reliable denial-of-service, causing the application process to crash without affecting confidentiality or integrity.
The official ImageMagick GitHub security advisory (GHSA-543g-8grm-9cw6) confirms that versions 7.1.2-15 and 6.9.13-40 address the issue with a targeted patch to properly validate YUV sampling factors. Security practitioners should update to these versions or later and consider disabling untrusted image processing features in affected deployments until patching is complete.
Details
- CWE(s)