CVE-2026-25799: 
C# vulnerability analysis and mitigation

CVE-2026-25799 is a Division-by-Zero vulnerability in ImageMagick's YUV image coder that allows unauthenticated remote attackers to cause a reliable denial-of-service by supplying a malformed image file. It affects ImageMagick versions prior to 7.1.2-15 (7.x branch) and prior to 6.9.13-40 (6.x branch), as well as Magick.NET NuGet packages prior to version 14.10.3. The vulnerability was published on February 23–24, 2026, with patches released simultaneously. It carries a CVSS v3.1 base score of 5.3 (Moderate) per the GitHub Security Advisory, though NVD assigns 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a logic error (CWE-369: Divide By Zero) in the YUV sampling factor validation routine within coders/yuv.c. An attacker can craft a YUV image file with an invalid sampling factor value that bypasses the existing validation checks; when ImageMagick subsequently attempts to use this value as a divisor at line 210 of coders/yuv.c, a division-by-zero occurs, triggering a fatal signal and crashing the process. The flaw is reachable via the ReadYUVImage function in the image loading pipeline, requiring no authentication or user interaction beyond submitting the malformed file for processing. The crash was confirmed via AddressSanitizer, which reported an UNKNOWN SIGNAL at coders/yuv.c:210 in ReadYUVImage (GitHub Advisory).

Successful exploitation results exclusively in a denial-of-service condition — the ImageMagick process crashes reliably upon loading the crafted image, making image processing unavailable. There is no confidentiality or integrity impact; attackers cannot read data or modify system state through this vulnerability. Any service or application that passes untrusted image files to a vulnerable ImageMagick instance (e.g., web applications with image upload functionality) is at risk of service disruption (GitHub Advisory, Red Hat Bugzilla).

1. Craft a malicious YUV image: Create a YUV image file with an invalid or zero-valued sampling factor that is designed to bypass ImageMagick's validation logic in coders/yuv.c.
2. Deliver the file to the target: Submit the crafted YUV file to any service or endpoint that processes images using a vulnerable ImageMagick version — for example, an image upload form on a web application, an email attachment processor, or a batch image conversion pipeline.
3. Trigger image loading: The target system invokes ReadYUVImage via the standard ImageMagick image loading pipeline (ReadImage → ReadYUVImage).
4. Trigger division-by-zero: At coders/yuv.c:210, the invalid sampling factor is used as a divisor, causing a division-by-zero and a fatal signal that crashes the ImageMagick process.
5. Achieve denial-of-service: The image processing service becomes unavailable; repeated submission of the crafted file can sustain the outage (GitHub Advisory).

• Logs: Application or system logs showing repeated crashes or fatal signals from the ImageMagick process (magick, convert, or similar binaries); error messages referencing coders/yuv.c or ReadYUVImage; AddressSanitizer output with UNKNOWN SIGNAL at coders/yuv.c:210 if instrumented builds are in use.
• Process: Unexpected termination of ImageMagick worker processes; increased process restart frequency for image-processing daemons or web server worker processes.
• File System: Presence of uploaded .yuv files or files with YUV content in upload directories, particularly those with anomalous or minimal file sizes.
• Network: Repeated submission of YUV-format image files from the same source IP to image upload or processing endpoints.

Upgrade ImageMagick to version 7.1.2-15 or later (7.x branch) or 6.9.13-40 or later (6.x branch). For Magick.NET users, upgrade to version 14.10.3 or later. If immediate patching is not possible, restrict network access to systems that process untrusted images, implement input validation to reject YUV-format files or malformed image headers before they reach ImageMagick, and monitor ImageMagick processes for unexpected crashes. Distribution-specific patches have been issued for Debian, Ubuntu (USN-8127-1), SUSE/openSUSE, and Amazon Linux 2 (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by researcher ylwango613 and published by ImageMagick maintainer dlemstra via GitHub Security Advisories on February 23, 2026. Red Hat tracked the issue via Bugzilla (Bug 2442120) and rated it medium severity. Multiple Linux distributions — including Debian, Ubuntu, SUSE, openSUSE, and Amazon Linux — issued security advisories and updated packages in the weeks following disclosure, reflecting routine but broad ecosystem response (GitHub Advisory, Red Hat Bugzilla).