CVE-2025-55004
CVE-2025-55004 · ImageMagick: heap-buffer overflow read in MNG magnification with alpha
This page contains facts from public vulnerability sources. Check the original advisory before updating.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, ImageMagick is vulnerable to heap-buffer overflow read around the handling of images with separate alpha channels when performing image magnification in ReadOneMNGIMage. This can likely be used to leak subsequent memory contents into the output image. This issue has been patched in version 7.1.2-1.
CVSS 7.6 · High · EPSS 0.5% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
imagemagick
- Versions
- < 7.1.2-1: Affected
No fix published
imagemagick Debian:13
- Versions
- 8:7.1.1.43+dfsg1-1
- 8:7.1.1.43+dfsg1-1+deb13u1
- Affected ranges
- ECOSYSTEM: < 8:7.1.1.43+dfsg1-1+deb13u2
Update to 8:7.1.1.43+dfsg1-1+deb13u2
imagemagick Debian:14
- Versions
- 8:7.1.1.43+dfsg1-1
- 8:7.1.1.46+dfsg1-1
- 8:7.1.1.47+dfsg1-1
- 8:7.1.1.47+dfsg1-2
- Affected ranges
- ECOSYSTEM: < 8:7.1.2.1+dfsg1-1
Update to 8:7.1.2.1+dfsg1-1
imagemagick Ubuntu:25.10
- Versions
- 8:7.1.1.43+dfsg1-1
- 8:7.1.1.43+dfsg1-1ubuntu1
- 8:7.1.1.43+dfsg1-1ubuntu2
- 8:7.1.2.3+dfsg1-1
- 8:7.1.2.3+dfsg1-1ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published