ImageMagick CVE-2025-62594

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:47 vuln.today

DescriptionCVE.org

Alpine Linux: imagemagick fixed in 7.1.2.8-r0

AnalysisAI

ImageMagick on Alpine Linux received a security fix packaged as version 7.1.2.8-r0, addressing an unspecified vulnerability in the image processing library. The nature, severity, and exploitability of the underlying flaw are not disclosed in available intelligence sources - no CVE description, CVSS vector, or CWE classification has been published. With an EPSS score of 0.02% (5th percentile), automated or widespread exploitation is considered highly unlikely at this time.

Technical ContextAI

ImageMagick is a widely deployed open-source image manipulation library and CLI toolset used for converting, editing, and composing raster and vector images across numerous programming language bindings. It has a long history of security vulnerabilities spanning memory corruption, code execution, SSRF, and file read primitives - the ImageTragick class of bugs being the most notable historical precedent. The Alpine Linux package version 7.1.2.8-r0 follows Alpine's naming convention where upstream version 7.1.2-8 is packaged with revision suffix -r0. No CWE root cause classification is available for this specific CVE, and no CPE string was provided, making it impossible to confirm the exact affected component or feature within ImageMagick from the available data.

Affected ProductsAI

The affected product is ImageMagick as packaged in Alpine Linux, fixed in Alpine package version 7.1.2.8-r0 (corresponding to upstream ImageMagick 7.1.2-8). The specific Alpine Linux release branch(es) affected are not identified in available data. No CPE string was provided. Affected version range prior to the fix is unknown - whether earlier Alpine package revisions or specific Alpine Linux major release series (e.g., Alpine 3.19, 3.20, Edge) are in scope cannot be confirmed from available intelligence. Users should consult the Alpine Linux security advisories at https://security.alpinelinux.org/ for authoritative scope.

RemediationAI

The primary remediation is to upgrade the ImageMagick Alpine Linux package to version 7.1.2.8-r0 or later using the standard Alpine package manager: 'apk upgrade imagemagick'. Since no vulnerability details are published, targeted workarounds cannot be prescribed - the specific feature or configuration to disable is unknown. As a general compensating control applicable to ImageMagick deployments pending patching, operators may restrict the image formats processed to only those strictly required using ImageMagick's policy.xml (located at /etc/ImageMagick-7/policy.xml), which can disable dangerous coders such as MVG, MSL, and PS. This has the trade-off of breaking legitimate use of those formats. Consult the Alpine Linux security tracker at https://security.alpinelinux.org/ and upstream ImageMagick changelogs at https://github.com/ImageMagick/ImageMagick/releases for additional context on the fix.