CVE Intelligence
Analysis AI-assisted

CVE-2026-25986: ImageMagick heap buffer overflow in YUV 4:2:2 decoder

A heap buffer overflow write in the ReadYUVImage() routine (coders/yuv.c) of ImageMagick can be triggered by crafted YUV 4:2:2 (NoInterlace) images. The record classifies it as CWE-787 and lists a CVSS 3.1 base score of 9.8 from NVD, while GitHub assigns 5.3. Versions 6.9.13-40 and 7.1.2-15 contain a patch, and the sources consulted show no confirmed exploitation.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

ImageMagick is an open-source suite for editing and manipulating images. CVE-2026-25986 describes a heap buffer write past the end of an allocated row in the YUV reader ReadYUVImage() in coders/yuv.c, which can be reached when processing YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the row buffer.

Impact

  • The record classifies the weakness as CWE-787 (Out-of-bounds Write).
  • NVD lists a CVSS 3.1 base score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, while GitHub lists 5.3 for the same issue.
  • The sources consulted do not describe consequences beyond the out-of-bounds write, so the practical impact in a given deployment is unknown.

Affected products and versions

  • Product in the record: ImageMagick (listed as Imagemagick Imagemagick).
  • The record lists the affected range as before 6.9.13-40 and from 7.0.0-0 up to before 7.1.2-15.
  • The description states that versions 6.9.13-40 and 7.1.2-15 contain a patch. The record's fixes list is empty, so the fix is confirmed only through the description text.

Exploitation status

  • The CISA KEV catalogue does not list this CVE in the record, so no active exploitation is confirmed.
  • No confirmed exploitation appears in the sources consulted.
  • EPSS shows a probability of 0.00573 and a percentile of 0.46641 in the record. SSVC lists exploitation as none and automatable as yes.

Remediation and mitigation

  • Upgrade to 6.9.13-40 on the 6.9 branch or to 7.1.2-15 on the 7.x branch, as stated in the description.
  • Where upgrading is not immediately possible, limit ImageMagick processing of untrusted YUV files and isolate image conversion services with least privilege.
  • Review the official GitHub advisory for the vendor's own guidance.

Detection guidance

  • Inventory all hosts and containers that run ImageMagick and record the installed version.
  • Monitor for unexpected crashes or abnormal terminations of processes that handle uploaded or external images.
  • Review logs of image-processing pipelines for failures on YUV inputs.

Limitations of the available information

  • The record contains only a short description and no detailed technical advisory text.
  • The exact consequences of the memory write and the conditions needed for them are unknown.
  • The EPSS date in the record is later than the publication date; treat the EPSS values as recorded and not as a current assessment.

Frequently asked questions

Which ImageMagick versions contain the patch?

The description states that versions 6.9.13-40 and 7.1.2-15 contain a patch. The record lists the affected range as before 6.9.13-40 and from 7.0.0-0 up to before 7.1.2-15.

Is this vulnerability known to be exploited in the wild?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. SSVC lists exploitation as none.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.