Skip to content

GHSA-543g-8grm-9cw6 CVE-2026-25799

ImageMagick has Division-by-Zero in YUV sampling factor validation, which leads to crash

High NuGet
Severity
5.3 / 10
High · CVSS 3.1
Exploit chance (EPSS)
0.44%
Chance of exploitation in the next 30 days. Higher than 38.02% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-369 Divide By Zero
Fix
Available
19 packages have a fixed version

Description

A logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service.

coders/yuv.c:210:47: runtime error: division by zero
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3543373==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x55deeb4d723c bp 0x7fffc28d34d0 sp 0x7fffc28d3320 T0)
    #0 0x55deeb4d723c in ReadYUVImage coders/yuv.c:210
    #1 0x55deeb751dff in ReadImage MagickCore/constitute.c:743
    #2 0x55deeb756374 in ReadImages MagickCore/constitute.c:1082
    #3 0x55deec682375 in CLINoImageOperator MagickWand/operation.c:4959
    #4 0x55deec6887ed in CLIOption MagickWand/operation.c:5473
    #5 0x55deec32843b in ProcessCommandOptions MagickWand/magick-cli.c:653
    #6 0x55deec32b99b in MagickImageCommand MagickWand/magick-cli.c:1392
    #7 0x55deec324d58 in MagickCommandGenesis MagickWand/magick-cli.c:177
    #8 0x55deead82519 in MagickMain utilities/magick.c:162
    #9 0x55deead828be in main utilities/magick.c:193
    #10 0x7fb90807fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #11 0x7fb90807fe3f in __libc_start_main_impl ../csu/libc-start.c:392
    #12 0x55deead81974 in _start (/data/ylwang/LargeScan/targets/ImageMagick/utilities/magick+0x22fb974)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: UNKNOWN SIGNAL coders/yuv.c:210 in ReadYUVImage
==3543373==ABORTING

Affected versions

NuGet

PackageVulnerableFixed in
Magick.NET-Q16-AnyCPU
< 14.10.3
14.10.3
Magick.NET-Q16-HDRI-AnyCPU
< 14.10.3
14.10.3
Magick.NET-Q16-HDRI-OpenMP-arm64
< 14.10.3
14.10.3
Magick.NET-Q16-HDRI-OpenMP-x64
< 14.10.3
14.10.3
Magick.NET-Q16-HDRI-arm64
< 14.10.3
14.10.3
Magick.NET-Q16-HDRI-x64
< 14.10.3
14.10.3
Magick.NET-Q16-HDRI-x86
< 14.10.3
14.10.3
Magick.NET-Q16-OpenMP-arm64
< 14.10.3
14.10.3
Magick.NET-Q16-OpenMP-x64
< 14.10.3
14.10.3
Magick.NET-Q16-OpenMP-x86
< 14.10.3
14.10.3
Magick.NET-Q16-arm64
< 14.10.3
14.10.3
Magick.NET-Q16-x64
< 14.10.3
14.10.3
Magick.NET-Q16-x86
< 14.10.3
14.10.3
Magick.NET-Q8-AnyCPU
< 14.10.3
14.10.3
Magick.NET-Q8-OpenMP-arm64
< 14.10.3
14.10.3
Magick.NET-Q8-OpenMP-x64
< 14.10.3
14.10.3
Magick.NET-Q8-arm64
< 14.10.3
14.10.3
Magick.NET-Q8-x64
< 14.10.3
14.10.3
Magick.NET-Q8-x86
< 14.10.3
14.10.3

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

Magick.NET-Q16-AnyCPU NuGet → 14.10.3

dotnet
dotnet add package Magick.NET-Q16-AnyCPU --version 14.10.3

Magick.NET-Q16-HDRI-AnyCPU NuGet → 14.10.3

dotnet
dotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.10.3

Magick.NET-Q16-HDRI-OpenMP-arm64 NuGet → 14.10.3

dotnet
dotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.10.3

Magick.NET-Q16-HDRI-OpenMP-x64 NuGet → 14.10.3

dotnet
dotnet add package Magick.NET-Q16-HDRI-OpenMP-x64 --version 14.10.3

Magick.NET-Q16-HDRI-arm64 NuGet → 14.10.3

dotnet
dotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.10.3

Magick.NET-Q16-HDRI-x64 NuGet → 14.10.3

dotnet
dotnet add package Magick.NET-Q16-HDRI-x64 --version 14.10.3

Magick.NET-Q16-HDRI-x86 NuGet → 14.10.3

dotnet
dotnet add package Magick.NET-Q16-HDRI-x86 --version 14.10.3

Magick.NET-Q16-OpenMP-arm64 NuGet → 14.10.3

dotnet
dotnet add package Magick.NET-Q16-OpenMP-arm64 --version 14.10.3

Magick.NET-Q16-OpenMP-x64 NuGet → 14.10.3

dotnet
dotnet add package Magick.NET-Q16-OpenMP-x64 --version 14.10.3

Magick.NET-Q16-OpenMP-x86 NuGet → 14.10.3

dotnet
dotnet add package Magick.NET-Q16-OpenMP-x86 --version 14.10.3

Magick.NET-Q16-arm64 NuGet → 14.10.3

dotnet
dotnet add package Magick.NET-Q16-arm64 --version 14.10.3

Magick.NET-Q16-x64 NuGet → 14.10.3

dotnet
dotnet add package Magick.NET-Q16-x64 --version 14.10.3

Magick.NET-Q16-x86 NuGet → 14.10.3

dotnet
dotnet add package Magick.NET-Q16-x86 --version 14.10.3

Magick.NET-Q8-AnyCPU NuGet → 14.10.3

dotnet
dotnet add package Magick.NET-Q8-AnyCPU --version 14.10.3

Magick.NET-Q8-OpenMP-arm64 NuGet → 14.10.3

dotnet
dotnet add package Magick.NET-Q8-OpenMP-arm64 --version 14.10.3

Magick.NET-Q8-OpenMP-x64 NuGet → 14.10.3

dotnet
dotnet add package Magick.NET-Q8-OpenMP-x64 --version 14.10.3

Magick.NET-Q8-arm64 NuGet → 14.10.3

dotnet
dotnet add package Magick.NET-Q8-arm64 --version 14.10.3

Magick.NET-Q8-x64 NuGet → 14.10.3

dotnet
dotnet add package Magick.NET-Q8-x64 --version 14.10.3

Magick.NET-Q8-x86 NuGet → 14.10.3

dotnet
dotnet add package Magick.NET-Q8-x86 --version 14.10.3

Severity breakdown

CVSS 3.1 5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Weakness

CWE-369: Divide By Zero

The product divides a value by zero.

References

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-j7hp-h8jx-5ppr
libwebp: OOB write in BuildHuffmanTable
High Known exploited Also affects magick.net-q16-anycpu
GHSA-cvhv-g4rq-3hmw
ImageMagick: Memory Leak when providing invalid options to the cli
Medium Also affects Magick.NET-Q16-AnyCPU
GHSA-h22j-f9xw-xjjm
ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds
Medium Also affects Magick.NET-Q16-AnyCPU
GHSA-422r-8c97-xcg4
ImageMagick: Heap Buffer Over-Write in fx operation
Medium Also affects Magick.NET-Q16-AnyCPU
GHSA-f5m7-cqgw-8hm7
ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided
Medium Also affects Magick.NET-Q16-AnyCPU
GHSA-hc76-7mpc-qjqh
ImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797
Medium Also affects Magick.NET-Q16-AnyCPU
GHSA-56m6-8q75-f2rw
ImageMagick: Policy Bypass due to an incomplete fix of CVE-2026-49219
Medium Also affects Magick.NET-Q16-AnyCPU
GHSA-h5r4-w88w-7ccr
ImageMagick: Memory Leak in TIFF encoder when invalid tiff:tile-geometry is specified
Low Also affects Magick.NET-Q16-AnyCPU
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor