CVE-2025-53019

| EUVD-2025-21390 LOW
2025-07-14 [email protected] GHSA-cfh4-9f7v-fhrc
3.7
CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

4
Patch Released
Mar 31, 2026 - 21:13 nvd
Patch available
Analysis Generated
Mar 16, 2026 - 09:43 vuln.today
EUVD ID Assigned
Mar 16, 2026 - 09:43 euvd
EUVD-2025-21390
CVE Published
Jul 14, 2025 - 20:15 nvd
LOW 3.7

Tags

Information Disclosure Buffer Overflow Ubuntu Debian

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue.

Analysis

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's magick stream command, specifying multiple consecutive %d format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue.

Technical Context

An out-of-bounds memory access occurs when code reads from or writes to memory locations outside the intended buffer boundaries. This vulnerability is classified as Out-of-bounds Read (CWE-125).

Affected Products

Affected products: Imagemagick Imagemagick

Remediation

Implement proper bounds checking on all array and buffer accesses. Use memory-safe languages or static analysis tools to detect OOB issues.

Priority Score

19
Low Medium High Critical
KEV: 0
EPSS: +0.1
CVSS: +18
POC: 0

Vendor Status

Ubuntu

Priority: Medium
imagemagick
Release Status Version
trusty not-affected code not present
upstream released 6.9.13-26, 7.1.2-0
bionic released 8:6.9.7.4+dfsg-16ubuntu6.15+esm4
focal released 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2
jammy released 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm2
plucky ignored end of life, was needed
noble released 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm1
xenial released 8:6.8.9.9-7ubuntu5.16+esm12
questing not-affected 8:7.1.1.47+dfsg1-2
USN-7728-1

Debian

Bug #1109339
imagemagick
Release Status Fixed Version Urgency
bullseye fixed 8:6.9.11.60+dfsg-1.3+deb11u6 -
bullseye (security) fixed 8:6.9.11.60+dfsg-1.3+deb11u10 -
bookworm fixed 8:6.9.11.60+dfsg-1.6+deb12u4 -
bookworm (security) fixed 8:6.9.11.60+dfsg-1.6+deb12u7 -
trixie fixed 8:7.1.1.43+dfsg1-1+deb13u1 -
trixie (security) fixed 8:7.1.1.43+dfsg1-1+deb13u6 -
forky fixed 8:7.1.2.15+dfsg1-2 -
sid fixed 8:7.1.2.16+dfsg1-1 -
(unstable) fixed 8:7.1.1.47+dfsg1-2 -
DLA-4297-1

Share

CVE-2025-53019 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy