Security readout for executives and security teams
Plain-English summary
ImageMagick versions before 7.1.2-15 and 6.9.13-40 can write past a memory buffer when handling malicious YUV 4:2:2 images. The published CVSS score is medium, focused on limited availability impact. Organizations are most exposed where ImageMagick processes untrusted uploaded or externally supplied images.
Executive priority
Treat as a moderate-priority patch for internet-facing or user-upload image workflows. Prioritize services that automatically process external images, because a crafted file may disrupt availability. No public source provided here confirms active exploitation.
Technical view
CVE-2026-25986 is a CWE-787 heap buffer overflow write in ReadYUVImage() in coders/yuv.c. For YUV 4:2:2 NoInterlace input, the pixel-pair loop writes one pixel beyond the allocated row buffer. A patch is reported in ImageMagick 7.1.2-15 and 6.9.13-40.
Likely exposure
Exposure is likely in applications, batch pipelines, web services, or content platforms using affected ImageMagick versions to process untrusted YUV images. Systems not using ImageMagick, not supporting YUV processing, or only processing trusted images have lower practical exposure.
Exploitation context
The source bundle does not report active exploitation, and KEV is false. The CVSS vector indicates network reachability, low complexity, no privileges, no user interaction, and low availability impact, with no confidentiality or integrity impact rated.
Researcher notes
The reported flaw is an off-by-one heap write in the YUV decoder row handling path. Analysis should focus on affected version ranges and reachable YUV parsing in application workflows. Do not assume broader impact beyond the advisory’s CVSS assessment without additional evidence.
Mitigation direction
- Upgrade ImageMagick to 7.1.2-15, 6.9.13-40, or later.
- Identify applications and containers that bundle ImageMagick.
- Restrict processing of untrusted YUV files until upgraded.
- Check the ImageMagick advisory for any updated vendor guidance.
Validation and detection
- Inventory installed ImageMagick versions across servers, containers, and build images.
- Confirm whether applications process YUV 4:2:2 or arbitrary uploaded images.
- Verify upgraded systems report fixed ImageMagick versions.
- Review image-processing services for exposure to external file submissions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-25986 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L3.91.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqfc-82jx-3mr2CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.