CVE-2026-25986: ImageMagick has heap buffer overflow in YUV 4:2:2 decoder

March 12, 2026

A heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer.

=================================================================
==204642==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5170000002e0 at pc 0x562d21a7e8de bp 0x7fffa9ae1270 sp 0x7fffa9ae1260
WRITE of size 8 at 0x5170000002e0 thread T0

References

github.com/ImageMagick/ImageMagick
github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqfc-82jx-3mr2
github.com/advisories/GHSA-mqfc-82jx-3mr2
github.com/dlemstra/Magick.NET/releases/tag/14.10.3
nvd.nist.gov/vuln/detail/CVE-2026-25986

Code Behaviors & Features

Detect and mitigate CVE-2026-25986 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →