ImageMagick CVE-2025-69204

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:48 vuln.today

DescriptionCVE.org

Alpine Linux: imagemagick fixed in 7.1.2.12-r0

AnalysisAI

ImageMagick on Alpine Linux received a security fix packaged as version 7.1.2.12-r0, addressing an unspecified vulnerability in the image processing library. The nature of the underlying flaw, its impact class, and affected attack surface are not disclosed in available intelligence sources. With an EPSS score of 0.13% (32nd percentile), exploitation probability is low, and no public exploit or active exploitation has been identified at time of analysis.

Technical ContextAI

ImageMagick is a widely-deployed open-source suite for image manipulation and conversion, supporting hundreds of formats. It has a long history of memory corruption, parsing, and command injection vulnerabilities due to its complex format parsers. This fix was distributed via Alpine Linux's package management system as 7.1.2.12-r0, suggesting the underlying ImageMagick upstream version is 7.1.2.12. No CWE classification is available, so the root cause class - whether memory corruption, input validation, code injection, or another class - cannot be determined from available data. No CPE strings were provided to further scope the affected component.

Affected ProductsAI

The affected product is ImageMagick as packaged by Alpine Linux, fixed at package version 7.1.2.12-r0. All Alpine Linux systems running ImageMagick versions prior to 7.1.2.12-r0 should be considered potentially affected. Exact Alpine Linux distribution release versions (e.g., Alpine 3.x edge/stable branches) and the upstream ImageMagick version range preceding the fix are not specified in available intelligence. No CPE strings were provided to further scope affected deployments.

RemediationAI

Upgrade the ImageMagick Alpine Linux package to version 7.1.2.12-r0 or later using the Alpine package manager: 'apk update && apk upgrade imagemagick'. This is the vendor-confirmed fix per Alpine Linux's security advisory. If immediate upgrade is not possible and ImageMagick is exposed to untrusted input (e.g., user-uploaded images processed server-side), consider restricting which image formats are accepted by configuring ImageMagick's policy.xml to disable high-risk format delegates (e.g., PS, PDF, SVG), though this may impact application functionality. No upstream vendor advisory URL was available in the provided intelligence data.