JLSEC-2026-949

See a problem?
Please try reporting it to the source first.
Source
https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-949.md
Import Source
https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-949.json
JSON Data
https://api.osv.dev/v1/vulns/JLSEC-2026-949
Upstream
  • EUVD-2026-7441
Published
2026-07-30T16:02:27.435Z
Modified
2026-07-30T18:35:35.612493939Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
ImageMagick has Division-by-Zero in YUV sampling factor validation, which leads to crash
Details

A logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service.

coders/yuv.c:210:47: runtime error: division by zero
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3543373==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x55deeb4d723c bp 0x7fffc28d34d0 sp 0x7fffc28d3320 T0)
    #0 0x55deeb4d723c in ReadYUVImage coders/yuv.c:210
    #1 0x55deeb751dff in ReadImage MagickCore/constitute.c:743
    #2 0x55deeb756374 in ReadImages MagickCore/constitute.c:1082
    #3 0x55deec682375 in CLINoImageOperator MagickWand/operation.c:4959
    #4 0x55deec6887ed in CLIOption MagickWand/operation.c:5473
    #5 0x55deec32843b in ProcessCommandOptions MagickWand/magick-cli.c:653
    #6 0x55deec32b99b in MagickImageCommand MagickWand/magick-cli.c:1392
    #7 0x55deec324d58 in MagickCommandGenesis MagickWand/magick-cli.c:177
    #8 0x55deead82519 in MagickMain utilities/magick.c:162
    #9 0x55deead828be in main utilities/magick.c:193
    #10 0x7fb90807fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #11 0x7fb90807fe3f in __libc_start_main_impl ../csu/libc-start.c:392
    #12 0x55deead81974 in _start (/data/ylwang/LargeScan/targets/ImageMagick/utilities/magick+0x22fb974)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: UNKNOWN SIGNAL coders/yuv.c:210 in ReadYUVImage
==3543373==ABORTING
Database specific 
{
    "sources": [
        {
            "id": "CVE-2026-25799",
            "imported": "2026-07-30T14:08:45.059Z",
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25799",
            "published": "2026-02-24T01:16:14.763Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-25799",
            "modified": "2026-06-17T10:25:15.923Z",
            "database_specific": {
                "status": "Analyzed"
            }
        },
        {
            "imported": "2026-07-30T14:10:42.885Z",
            "html_url": "https://github.com/advisories/GHSA-543g-8grm-9cw6",
            "published": "2026-02-24T15:37:53Z",
            "url": "https://api.github.com/advisories/GHSA-543g-8grm-9cw6",
            "modified": "2026-02-24T15:37:56Z",
            "id": "GHSA-543g-8grm-9cw6"
        },
        {
            "id": "EUVD-2026-7441",
            "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-7441",
            "published": "2026-02-24T01:05:39Z",
            "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-7441",
            "modified": "2026-02-26T15:22:25Z",
            "imported": "2026-07-30T14:08:55.191Z"
        }
    ],
    "license": "CC-BY-4.0"
}
References
Credits

Affected packages

Julia / ImageMagick_jll

Package

Name
ImageMagick_jll
Purl
pkg:julia/ImageMagick_jll?uuid=c73af94c-d91f-53ed-93a7-00f77d67a9d7

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7.1.2023+0

Database specific

source 
"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-949.json"