ImageMagick up to 6.9.13-39/7.1.2-14 Image Parser divide by zero

Summaryinfo

A vulnerability categorized as problematic has been discovered in ImageMagick up to 6.9.13-39/7.1.2-14. This impacts an unknown function of the component Image Parser. Executing a manipulation can lead to divide by zero. This vulnerability appears as CVE-2026-25799. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in ImageMagick up to 6.9.13-39/7.1.2-14. It has been declared as problematic. This vulnerability affects an unknown functionality of the component Image Parser. The manipulation with an unknown input leads to a divide by zero vulnerability. The CWE definition for the vulnerability is CWE-369. The product divides a value by zero. As an impact it is known to affect availability. CVE summarizes:

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-25799 since 02/05/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability scanner Nessus provides a plugin with the ID 299969 (Linux Distros Unpatched Vulnerability : CVE-2026-25799), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.9.13-40 or 7.1.2-15 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (299969) and CERT Bund (WID-SEC-2026-0484). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• Open Source ImageMagick

Productinfo

Type

• Image Processing Software

Name

• ImageMagick

Version

• 6.9.13-39
• 7.1.2-14

License

• open-source

Website

• Product: https://www.imagemagick.org/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion