ImageMagick CVE-2025-57807

Exploitation requires the application to feed attacker-controlled image data through ImageMagick's memory-backed blob path (BlobStream) where a code path invokes SeekBlob() to advance the stream offset forward beyond the current end, followed by WriteBlob() - the under-allocation then writes past the buffer. Target must be a 64-bit (LP64) build; the advisory observed it on macOS arm64 and notes it is architecture-agnostic on LP64. Explicitly NOT required: external delegates, special security policy settings, or 2⁶⁴ integer wraparound. Limiting factors: reachability depends on which coder/operation drives a forward seek before write, and on the integrating application actually passing untrusted images to ImageMagick; no authentication is required per the CVSS vector (PR:N), but a vulnerable processing workflow must be exposed to attacker input.

Signals conflict sharply and must be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H → 9.8) describes a maximally severe, unauthenticated, low-complexity network flaw, and the technical evidence supports a serious, *deterministic* heap out-of-bounds write (attacker-controlled bytes at an attacker-chosen offset) with potential for code execution. A public writeup/advisory (GHSA-23hg-53q6-hqfg) and vendor patch commit exist, so 'publicly available exploit code exists.' However, the exploitation-probability signals pull the other way: EPSS is only 0.04% (13th percentile) and the CVE is NOT in CISA KEV - there is no evidence of active, widespread exploitation. The low EPSS alongside a public PoC suggests the capability is documented but not yet operationalized at scale, likely because real-world reachability depends on the host application actually driving ImageMagick's BlobStream through a forward-seek-then-write path. Net: this is a genuinely high-severity memory-corruption primitive in a very widely deployed library and should be patched promptly, but the raw 9.8 overstates near-term mass-exploitation likelihood given a 0.04% EPSS and no KEV listing - treat as high-priority patch, not confirmed active-attack emergency. Note a versioning caveat: the 'fixed in 14.8.2' figure comes from the Magick.NET NuGet wrappers, while the core ImageMagick advisory was tested against 7.1.2-0/7.1.2-1 - confirm the exact fixed build for your distribution.

An attacker submits a crafted image file to a service that processes it with a vulnerable ImageMagick build (e.g., an upload/thumbnailing endpoint). During memory-backed blob I/O, a forward SeekBlob() pushes the offset past the end of the buffer and the subsequent WriteBlob() under-allocates, copying attacker bytes beyond the allocation and corrupting the heap. Public advisory and patch-level detail exist (PoC-grade), so a working exploit path is realistic, though no active exploitation is confirmed (not in KEV, EPSS 0.04%).