PT-2025-36333 · Unknown+6 · Imagemagick+6
Mescuwa
·
Published
2025-09-05
·
Updated
2025-12-15
·
CVE-2025-57807
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ImageMagick versions prior to 14.8.2
Description
ImageMagick is free and open-source software used for editing and manipulating digital images. The software includes insecure functions:
SeekBlob(), which allows advancing the stream offset beyond the current end without increasing capacity, and WriteBlob(), which expands by quantum + length instead of offset + length, and copies to data + offset. When offset is significantly larger than the extent, the copy targets memory beyond the allocation, resulting in a heap write on 64-bit builds. This does not require 2⁶⁴ arithmetic wrap, external delegates, or policy settings.Recommendations
Update to version 14.8.2 or later.
Exploit
Fix
RCE
Memory Corruption
Stack Overflow
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Debian
Imagemagick
Linuxmint
Red Os
Suse
Ubuntu