Skip to main content

Imagemagick CVE-2025-53015

HIGH
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2025-07-14 security-advisories@github.com GHSA-vmhh-8rxq-fp9g
Information Disclosure Red Hat Imagemagick Suse
7.5
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM
qualitative
SUSE
HIGH
qualitative
Red Hat
5.3 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
Analysis Generated
Mar 16, 2026 - 09:43 vuln.today
PoC Detected
Oct 08, 2025 - 17:06 vuln.today
Public exploit code
CVE Published
Jul 14, 2025 - 20:15 nvd
HIGH 7.5

DescriptionGitHub Advisory

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0, infinite lines occur when writing during a specific XMP file conversion command. Version 7.1.2-0 fixes the issue.

AnalysisAI

CVE-2025-53015 is a denial-of-service vulnerability in ImageMagick versions prior to 7.1.2-0 that causes infinite loops during XMP file conversion operations. An unauthenticated attacker can trigger this vulnerability remotely by submitting a maliciously crafted XMP file, resulting in resource exhaustion and service unavailability. The vulnerability has a CVSS score of 7.5 (High) due to its network-exploitable nature and availability impact, though it does not affect confidentiality or integrity.

Technical ContextAI

ImageMagick is a widely-used image processing library and command-line tool (CPE: cpe:2.3:a:imagemagick:imagemagick) that handles multiple image formats including XMP (Extensible Metadata Platform) metadata. The vulnerability resides in the XMP file parsing/conversion logic, specifically in CWE-835 (Infinite Loop), where improper control flow handling during XMP metadata processing causes the application to enter an unbounded loop. When ImageMagick processes a specially crafted XMP file through conversion commands, the parser fails to properly validate or terminate loop conditions, consuming CPU and memory resources indefinitely. This is a classic infinite loop vulnerability where the exit condition is never met due to malformed or adversarial XMP structure.

RemediationAI

Immediate remediation: upgrade ImageMagick to version 7.1.2-0 or later. Vendor patch is available as of the release date of 7.1.2-0. Interim mitigations if upgrade is delayed: (1) disable or restrict XMP file processing if not required; (2) implement input validation to reject XMP files or limit processing to trusted sources; (3) add timeout/resource limits to ImageMagick process execution (ulimit, cgroups) to prevent full system exhaustion; (4) deploy rate limiting on image upload/conversion endpoints; (5) consider using alternative image processing libraries for XMP handling if available; (6) monitor process resource usage for signs of infinite loops. For containerized deployments, rebuild images with ImageMagick 7.1.2-0+. For package managers (apt, yum, brew), update via standard channels once packages are available.

More in Imagemagick

View all
CVE-2016-3714 HIGH POC
8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
CVE-2016-3718 MEDIUM POC
5.5 May 05

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct

CVE-2016-3715 MEDIUM POC
5.5 May 05

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary fi
CVE-2017-15277 MEDIUM POC
6.5 Oct 12

ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
CVE-2016-5841 CRITICAL POC
9.8 Dec 13

Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
CVE-2016-3717 MEDIUM POC
5.5 May 05

The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
CVE-2016-5118 CRITICAL
9.8 Jun 10

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
CVE-2016-5689 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2016-5690 CRITICAL POC
9.8 Dec 13

The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to

CVE-2016-5691 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2017-14138 CRITICAL POC
9.8 Sep 04

ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
CVE-2026-23876 CRITICAL POC
9.8 Jan 20

Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8
CVE-2026-66730 HIGH POC
8.7

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

Ubuntu

Priority: Medium
imagemagick
Release Status Version
bionic not-affected code not present
focal not-affected code not present
jammy not-affected code not present
noble not-affected code not present
plucky not-affected code not present
questing not-affected 8:7.1.2.3+dfsg1-1
trusty not-affected code not present
upstream released 7.1.2-0
xenial not-affected code not present

Debian

Bug #1109339
imagemagick
Release Status Fixed Version Urgency
bullseye not-affected - -
bullseye (security) fixed 8:6.9.11.60+dfsg-1.3+deb11u10 -
bookworm not-affected - -
bookworm (security) fixed 8:6.9.11.60+dfsg-1.6+deb12u7 -
trixie fixed 8:7.1.1.43+dfsg1-1+deb13u1 -
trixie (security) fixed 8:7.1.1.43+dfsg1-1+deb13u6 -
forky fixed 8:7.1.2.15+dfsg1-2 -
sid fixed 8:7.1.2.16+dfsg1-1 -
(unstable) fixed 8:7.1.1.47+dfsg1-2 -

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP6 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP6 Fixed

Share

CVE-2025-53015 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy