Vulnerability · Published Aug 13, 2025 · Assigned by GitHub_M
CVE-2025-55004ImageMagick: heap-buffer overflow read in MNG magnification with alpha
High 7.6
In plain English
A high-severity heap buffer overflow in ImageMagick from ImageMagick. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, ImageMagick is vulnerable to heap-buffer overflow read around the handling of images with separate alpha channels when performing image magnification in ReadOneMNGIMage. This can likely be used to leak subsequent memory contents into the output image. This issue has been patched in version 7.1.2-1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | imagemagick | 8:7.1.1.43+dfsg1-1+deb13u2 | DEBIAN-CVE-2025-55004 |
| Debian:14 | imagemagick | 8:7.1.2.1+dfsg1-1 | DEBIAN-CVE-2025-55004 |
| NuGet | magick.net-q16-anycpu | 14.8.0 | GHSA-cjc8-g9w8-chfw |
| NuGet | magick.net-q16-arm64 | 14.8.0 | GHSA-cjc8-g9w8-chfw |
| NuGet | magick.net-q16-hdri-anycpu | 14.8.0 | GHSA-cjc8-g9w8-chfw |
| NuGet | magick.net-q16-hdri-arm64 | 14.8.0 | GHSA-cjc8-g9w8-chfw |
| NuGet | magick.net-q16-hdri-openmp-arm64 | 14.8.0 | GHSA-cjc8-g9w8-chfw |
| NuGet | magick.net-q16-hdri-openmp-x64 | 14.8.0 | GHSA-cjc8-g9w8-chfw |
| NuGet | magick.net-q16-hdri-x64 | 14.8.0 | GHSA-cjc8-g9w8-chfw |
| NuGet | magick.net-q16-hdri-x86 | 14.8.0 | GHSA-cjc8-g9w8-chfw |
| NuGet | magick.net-q16-openmp-arm64 | 14.8.0 | GHSA-cjc8-g9w8-chfw |
| NuGet | magick.net-q16-openmp-x64 | 14.8.0 | GHSA-cjc8-g9w8-chfw |
| NuGet | magick.net-q16-x64 | 14.8.0 | GHSA-cjc8-g9w8-chfw |
| NuGet | magick.net-q16-x86 | 14.8.0 | GHSA-cjc8-g9w8-chfw |
| NuGet | magick.net-q8-anycpu | 14.8.0 | GHSA-cjc8-g9w8-chfw |
| NuGet | magick.net-q8-arm64 | 14.8.0 | GHSA-cjc8-g9w8-chfw |
| NuGet | magick.net-q8-openmp-arm64 | 14.8.0 | GHSA-cjc8-g9w8-chfw |
| NuGet | magick.net-q8-openmp-x64 | 14.8.0 | GHSA-cjc8-g9w8-chfw |
| NuGet | magick.net-q8-x64 | 14.8.0 | GHSA-cjc8-g9w8-chfw |
| NuGet | magick.net-q8-x86 | 14.8.0 | GHSA-cjc8-g9w8-chfw |
| Ubuntu:25.10 | imagemagick | no fix listed | UBUNTU-CVE-2025-55004 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ImageMagick | ImageMagick | < 7.1.2-1 |
Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
References
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cjc8-g9w8-chfw x_refsource_CONFIRM
- https://goo.gle/bigsleep x_refsource_MISC