CVE-2026-25799
Published: 24 February 2026
Summary
CVE-2026-25799 is a medium-severity Divide By Zero (CWE-369) vulnerability in Imagemagick Imagemagick. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 5.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-25799 is a logic error in the YUV sampling factor validation within ImageMagick, a free and open-source software suite for editing and manipulating digital images. In versions prior to 7.1.2-15 (for the 7.x branch) and 6.9.13-40 (for the 6.x branch), an invalid sampling factor can bypass validation checks, leading to a division-by-zero error during image loading. This vulnerability, classified under CWE-369 (Divide by Zero), carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), indicating medium severity primarily due to its impact on availability.
The vulnerability can be exploited remotely by unauthenticated attackers with network access, requiring low complexity and no user interaction. By crafting a malicious image file with an invalid YUV sampling factor and inducing a targeted ImageMagick instance to load it—such as through a web application or image processing pipeline—the attacker triggers a reliable denial-of-service, causing the application process to crash without affecting confidentiality or integrity.
The official ImageMagick GitHub security advisory (GHSA-543g-8grm-9cw6) confirms that versions 7.1.2-15 and 6.9.13-40 address the issue with a targeted patch to properly validate YUV sampling factors. Security practitioners should update to these versions or later and consider disabling untrusted image processing features in affected deployments until patching is complete.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7441
Vulnerability details
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during…
more
image loading, resulting in a reliable denial-of-service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Division-by-zero crash on crafted image load directly enables remote application DoS via software vulnerability exploitation (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of the vendor patch that fixes the YUV sampling-factor validation flaw.
Mandates validation of all input data, which would reject the invalid sampling factor that triggers the division-by-zero.
Least-functionality principle supports disabling untrusted image-processing features until the vulnerable ImageMagick instance is updated.