CVE-2025-53014
BaseFortify
Publication date: 2025-07-14
Last updated on: 2025-11-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| imagemagick | imagemagick | From 7.0.11-13 (inc) to 7.1.1-36 (inc) |
| imagemagick | imagemagick | From 7.0.11-13 (inc) to 7.1.1-36 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
| CWE-193 | A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a heap buffer overflow in the InterpretImageFilename function of ImageMagick. It occurs due to an off-by-one error when processing format strings containing consecutive percent signs ("%%"). Specifically, the function incorrectly advances a pointer beyond the allocated memory buffer, causing out-of-bounds memory access. This flaw can lead to a crash or potential memory corruption when the "magick" utility processes such input. [1]
How can this vulnerability impact me? :
The vulnerability has a low severity score (CVSS 3.7) and can be exploited remotely without privileges or user interaction. It may cause the ImageMagick process to crash due to heap buffer overflow, potentially leading to denial of service. However, it has only a low impact on confidentiality and no impact on integrity or availability, so the risk of data breach or system compromise is limited. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the ImageMagick 'magick' utility with format strings containing consecutive percent signs ('%%'). Using AddressSanitizer during compilation can help detect the heap buffer overflow. For example, running a command like `magick '%%' image.jpg output.jpg` may trigger the overflow and cause a crash if the vulnerable version is present. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade ImageMagick to version 7.1.2-0 or later, or 6.9.13-26 or later, where the vulnerability is fixed. Avoid processing format strings with consecutive percent signs ('%%') until the update is applied. [1]