PT-2025-34799 · Unknown+6 · Imagemagick+6
Mescuwa
·
Published
2025-08-23
·
Updated
2025-12-15
·
CVE-2025-57803
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ImageMagick versions prior to 6.9.13-28 and 7.1.2-2
Description
ImageMagick is free and open-source software used for editing and manipulating digital images. A 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses
bytes per line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines.Recommendations
Update to ImageMagick version 6.9.13-28 or 7.1.2-2.
Exploit
Fix
DoS
RCE
Integer Overflow
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Debian
Imagemagick
Linuxmint
Red Os
Suse
Ubuntu