EUVD-2025-21390
GHSA-cfh4-9f7v-fhrc
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's magick stream command, specifying multiple consecutive %d format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue.
Analysis
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's magick stream command, specifying multiple consecutive %d format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue.
Technical ContextAI
An out-of-bounds memory access occurs when code reads from or writes to memory locations outside the intended buffer boundaries. This vulnerability is classified as Out-of-bounds Read (CWE-125).
RemediationAI
Implement proper bounds checking on all array and buffer accesses. Use memory-safe languages or static analysis tools to detect OOB issues.
More in Imagemagick
View allThe (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary fi
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| trusty | not-affected | code not present |
| upstream | released | 6.9.13-26, 7.1.2-0 |
| bionic | released | 8:6.9.7.4+dfsg-16ubuntu6.15+esm4 |
| focal | released | 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2 |
| jammy | released | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm2 |
| plucky | ignored | end of life, was needed |
| noble | released | 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm1 |
| xenial | released | 8:6.8.9.9-7ubuntu5.16+esm12 |
| questing | not-affected | 8:7.1.1.47+dfsg1-2 |
Debian
Bug #1109339| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 8:6.9.11.60+dfsg-1.3+deb11u6 | - |
| bullseye (security) | fixed | 8:6.9.11.60+dfsg-1.3+deb11u10 | - |
| bookworm | fixed | 8:6.9.11.60+dfsg-1.6+deb12u4 | - |
| bookworm (security) | fixed | 8:6.9.11.60+dfsg-1.6+deb12u7 | - |
| trixie | fixed | 8:7.1.1.43+dfsg1-1+deb13u1 | - |
| trixie (security) | fixed | 8:7.1.1.43+dfsg1-1+deb13u6 | - |
| forky | fixed | 8:7.1.2.15+dfsg1-2 | - |
| sid | fixed | 8:7.1.2.16+dfsg1-1 | - |
| (unstable) | fixed | 8:7.1.1.47+dfsg1-2 | - |
Share
External POC / Exploit Code
Leaving vuln.today