Safety researchers have uncovered 4 critical vulnerabilities in ImageMagick, one of many world’s most generally used open-source picture processing software program suites, doubtlessly exposing thousands and thousands of customers to safety dangers.
The vulnerabilities, found by researcher “urban-warrior” and revealed three days in the past, embody two high-severity flaws that would permit attackers to execute malicious code by means of specifically crafted picture recordsdata.
ImageMagick builders have already launched patches addressing these points, however organizations and particular person customers are urged to replace their installations instantly to forestall potential exploitation.
Probably the most extreme vulnerabilities focus on ImageMagick’s dealing with of MNG (A number of-image Community Graphics) file format, particularly within the picture magnification performance.
Important Reminiscence Corruption Flaws
The primary crucial flaw, tracked as CVE-2025-55154 with the interior identifier BIGSLEEP-435153105, includes integer overflow vulnerabilities within the MNG magnification calculations.
When processing maliciously crafted MNG recordsdata, the software program performs unsafe calculations that may overflow, resulting in reminiscence corruption and potential code execution.
The vulnerability happens within the ReadOneMNGImage perform inside the coders/png.c file, the place magnified dimension calculations use 32-bit unsigned integers that may overflow when processing photos with massive dimensions.
This overflow causes the software program to allocate inadequate reminiscence buffers whereas nonetheless utilizing the unique, bigger parameters for magnification operations, leading to out-of-bounds writes to heap reminiscence with managed information.
A second high-severity vulnerability, CVE-2025-55004 (BIGSLEEP-436829309), impacts the identical magnification performance however particularly targets photos with alpha channels.
This flaw creates heap buffer overflow situations when ImageMagick processes MNG recordsdata containing separate alpha channel information, doubtlessly permitting attackers to leak reminiscence contents into output photos or trigger software crashes.
The found vulnerabilities exploit elementary weaknesses in ImageMagick’s reminiscence administration and enter validation programs. The important thing technical traits of those flaws embody:
Integer Overflow Exploitation: Requires photos with dimensions approaching 65,535 pixels, usually prevented by default safety insurance policies limiting dimensions to eight,000 pixels.
Alpha Channel Bypass: May be triggered with out violating customary safety insurance policies, making it notably harmful for manufacturing environments.
Reminiscence Allocation Mismatch: Creates discrepancies between allotted buffer sizes and precise processing necessities.
Heap Buffer Corruption: Permits out-of-bounds reminiscence writes with attacker-controlled information.
The alpha channel vulnerability presents a very regarding assault vector as a result of it may be triggered with out violating customary safety insurance policies.
The flaw happens when ImageMagick updates picture metadata to incorporate alpha channel info after initially calculating buffer sizes, making a mismatch between allotted reminiscence and precise necessities throughout subsequent processing operations.
Two extra moderate-severity vulnerabilities compound the safety issues. CVE-2025-55005 (BIGSLEEP-435156754) impacts log colorspace dealing with, the place improper validation of reference-black and reference-white values may cause heap buffer overflows when these values exceed 1024.
The fourth vulnerability, CVE-2025-55160, includes undefined habits within the CloneSplayTree perform, which might result in software crashes in sanitizer-enabled builds.
Patches & Suggestions
ImageMagick builders have responded swiftly to those discoveries, releasing patched variations that deal with all recognized vulnerabilities.
Customers of ImageMagick 7.x ought to improve to model 7.1.2-1 or later, whereas these utilizing the legacy 6.x department ought to replace to model 6.9.13-27 or newer.
The patches implement correct bounds checking, repair reminiscence allocation calculations, and resolve the perform pointer kind mismatches that enabled these vulnerabilities.
Organizations counting on ImageMagick for internet functions, content material administration programs, or automated picture processing workflows ought to prioritize these updates instantly.
The network-based assault vector of the first vulnerabilities, mixed with their excessive CVSS scores starting from 8.8 to 9.8, signifies that profitable exploitation might result in full system compromise.
Safety directors also needs to assessment their ImageMagick safety insurance policies, making certain that applicable limits stay in place for picture dimensions, file sizes, and supported codecs.
Whereas the websafe safety coverage would block a few of these vulnerabilities, the alpha channel flaw demonstrates that restrictive insurance policies alone can’t present full safety.
The invention of those vulnerabilities highlights the continuing safety challenges dealing with widely-deployed open-source software program, notably instruments that course of untrusted enter from exterior sources.
Common safety auditing and immediate patch deployment stay important elements of sustaining safe picture processing infrastructures.
Enhance your SOC and assist your staff defend your corporation with free top-notch menace intelligence: Request TI Lookup Premium Trial.
