Logo
›
›vulnerability›CVE-2026-25795
Name
CVE-2026-25795
Source
NVD ( link)Debian ( link)
Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer dereference and crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CWEs
CWE-476
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p33r-fqw2-rqmmVendor Advisory

Analysis#

Affected Component
Analysis
imagemagick
Patched

Vulnerability Ratings#

5.3
CVSSv31
7.5
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
imagemagick
buildroot
2025.02.x
7.1.2-23
Not Affected
imagemagick
buildroot
master
7.1.2-23
Not Affected
imagemagick
openwrt
master
7.1.2.21-r1
Not Affected
imagemagick
openwrt
openwrt-25.12
7.1.2.1-r1
Not Affected
imagemagick
yocto
kirkstone
7.0.10-62
Exploitable
imagemagick
yocto
master
7.1.2-25
Not Affected

Resolved with patches#

imagemagick (yocto:scarthgap)

#
Title
Author
Resolve
1
Fixed NULL pointer dereference in ReadSFWImage (GHSA-p33r-fqw2-rqmm)
Dirk Lemstra <dirk@lemstra.org>
CVE-2026-25795