CVE-2026-25986: ImageMagick has a heap buffer overflow in YUV 4:2:2 decoder
A heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer.
================================================================= ==204642==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5170000002e0 at pc 0x562d21a7e8de bp 0x7fffa9ae1270 sp 0x7fffa9ae1260 WRITE of size 8 at 0x5170000002e0 thread T0
Other sources
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25986?
CVE-2026-25986 has a critical severity due to its potential to allow arbitrary code execution through a heap buffer overflow.
How do I fix CVE-2026-25986?
To fix CVE-2026-25986, upgrade to ImageMagick version 7.1.2-15 or later for the 7.x series, and 6.9.13-40 or later for the 6.x series.
What versions of ImageMagick are affected by CVE-2026-25986?
ImageMagick versions prior to 7.1.2-15 and 6.9.13-40 are affected by CVE-2026-25986.
What kind of vulnerability is CVE-2026-25986?
CVE-2026-25986 is a heap buffer overflow vulnerability that occurs in the YUV 4:2:2 decoder.
Is CVE-2026-25986 exploitable remotely?
Yes, CVE-2026-25986 can be exploited remotely if an attacker can craft a malicious YUV image processed by ImageMagick.