CVE-2025-53015
HIGH
GHSA-vmhh-8rxq-fp9g
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4Description
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0, infinite lines occur when writing during a specific XMP file conversion command. Version 7.1.2-0 fixes the issue.
Analysis
CVE-2025-53015 is a denial-of-service vulnerability in ImageMagick versions prior to 7.1.2-0 that causes infinite loops during XMP file conversion operations. An unauthenticated attacker can trigger this vulnerability remotely by submitting a maliciously crafted XMP file, resulting in resource exhaustion and service unavailability. The vulnerability has a CVSS score of 7.5 (High) due to its network-exploitable nature and availability impact, though it does not affect confidentiality or integrity.
Technical Context
ImageMagick is a widely-used image processing library and command-line tool (CPE: cpe:2.3:a:imagemagick:imagemagick) that handles multiple image formats including XMP (Extensible Metadata Platform) metadata. The vulnerability resides in the XMP file parsing/conversion logic, specifically in CWE-835 (Infinite Loop), where improper control flow handling during XMP metadata processing causes the application to enter an unbounded loop. When ImageMagick processes a specially crafted XMP file through conversion commands, the parser fails to properly validate or terminate loop conditions, consuming CPU and memory resources indefinitely. This is a classic infinite loop vulnerability where the exit condition is never met due to malformed or adversarial XMP structure.
Affected Products
ImageMagick all versions prior to 7.1.2-0 are affected. Specific affected CPE: cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* (versions < 7.1.2-0). This includes: ImageMagick 7.1.1-x and earlier; ImageMagick 7.0.x series; legacy 6.x branches if still in use. Affected configurations include any deployment where ImageMagick is used to convert or process XMP metadata, including: web applications using ImageMagick for image upload/processing, Docker/containerized services running vulnerable versions, server-side image APIs, CDN image optimization services, and automated content processing pipelines. The vulnerability is triggered via the XMP conversion command path specifically, so any system invoking ImageMagick's convert, magick, or identify commands on XMP files is at risk.
Remediation
Immediate remediation: upgrade ImageMagick to version 7.1.2-0 or later. Vendor patch is available as of the release date of 7.1.2-0. Interim mitigations if upgrade is delayed: (1) disable or restrict XMP file processing if not required; (2) implement input validation to reject XMP files or limit processing to trusted sources; (3) add timeout/resource limits to ImageMagick process execution (ulimit, cgroups) to prevent full system exhaustion; (4) deploy rate limiting on image upload/conversion endpoints; (5) consider using alternative image processing libraries for XMP handling if available; (6) monitor process resource usage for signs of infinite loops. For containerized deployments, rebuild images with ImageMagick 7.1.2-0+. For package managers (apt, yum, brew), update via standard channels once packages are available.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| bionic | not-affected | code not present |
| focal | not-affected | code not present |
| jammy | not-affected | code not present |
| noble | not-affected | code not present |
| plucky | not-affected | code not present |
| questing | not-affected | 8:7.1.2.3+dfsg1-1 |
| trusty | not-affected | code not present |
| upstream | released | 7.1.2-0 |
| xenial | not-affected | code not present |
Debian
Bug #1109339| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | not-affected | - | - |
| bullseye (security) | fixed | 8:6.9.11.60+dfsg-1.3+deb11u10 | - |
| bookworm | not-affected | - | - |
| bookworm (security) | fixed | 8:6.9.11.60+dfsg-1.6+deb12u7 | - |
| trixie | fixed | 8:7.1.1.43+dfsg1-1+deb13u1 | - |
| trixie (security) | fixed | 8:7.1.1.43+dfsg1-1+deb13u6 | - |
| forky | fixed | 8:7.1.2.15+dfsg1-2 | - |
| sid | fixed | 8:7.1.2.16+dfsg1-1 | - |
| (unstable) | fixed | 8:7.1.1.47+dfsg1-2 | - |
Share
External POC / Exploit Code
Leaving vuln.today