Multiple ImageMagick Vulnerabilities Expose Users to Memory Corruption and Integer Overflow Risks
Security experts have identified four critical vulnerabilities in ImageMagick, one of the most popular open-source image processing tools, potentially putting millions of users at risk.
Discovered by researcher “urban-warrior” and reported three days ago, the flaws include two high-risk issues that could allow attackers to execute malicious code via specially crafted image files.
ImageMagick developers have released patches to address these vulnerabilities. Users and organizations are strongly advised to update their software immediately to prevent exploitation.
Critical Issues in MNG Image Handling
The most dangerous flaws are related to ImageMagick’s handling of MNG (Multiple-image Network Graphics) files, particularly in the magnification functionality.
Memory Corruption Through Integer Overflow
The first major vulnerability, CVE-2025-55154 (internal ID BIGSLEEP-435153105), is an integer overflow issue in MNG magnification calculations. Maliciously crafted MNG files can trigger unsafe calculations that overflow, causing memory corruption and possible code execution.
This occurs in the ReadOneMNGImage function in coders/png.c, where 32-bit unsigned integers are used for magnification size calculations. Large image dimensions can overflow these integers, resulting in insufficient memory allocation but continuing to use the original magnification parameters, which leads to out-of-bounds memory writes with attacker-controlled data.
Alpha Channel Vulnerability
A second high-risk flaw, CVE-2025-55004 (BIGSLEEP-436829309), affects the same magnification functionality but targets images with alpha channels. It can create heap buffer overflows, potentially exposing memory contents or causing application crashes.
Technical Summary of Flaws
- Integer overflow occurs with images approaching 65,535 pixels; default security policies often restrict to 8,000 pixels.
- Alpha channel exploitation bypasses standard security policies, posing a significant threat in production environments.
- Memory allocation mismatches lead to discrepancies between allocated buffer sizes and actual requirements.
- Heap buffer corruption allows attackers to write data out of bounds.
The alpha channel flaw is particularly dangerous as it can be exploited without triggering standard security policies. It arises when ImageMagick updates image metadata to include alpha information after the initial buffer size calculation, causing memory allocation mismatches during further processing.
Additional Moderate Vulnerabilities
Two other vulnerabilities increase security concerns. CVE-2025-55005 (BIGSLEEP-435156754) affects log colorspace handling, causing heap buffer overflows when reference-black and reference-white values exceed 1024. CVE-2025-55160 may trigger crashes in builds with sanitizers due to undefined behavior in the CloneSplayTree function.
Patches and Recommendations
Patched versions are now available. Users of ImageMagick 7.x should upgrade to 7.1.2-1 or later, and those on 6.x should update to 6.9.13-27 or newer.
The updates implement proper bounds checking, fix memory allocation calculations, and correct function pointer mismatches. Organizations using ImageMagick for web apps, content management, or automated image processing should prioritize these updates.
High CVSS scores (8.8–9.8) and network-based attack potential make timely patching crucial. Administrators should review security policies for image dimensions, file sizes, and supported formats. While websafe policies mitigate some risks, the alpha channel flaw shows restrictive policies alone are insufficient.
These vulnerabilities emphasize the persistent security challenges of open-source software, especially tools processing untrusted external input. Regular audits and immediate patch deployment remain essential for safe image processing infrastructure.
