CVE-2025-55212
BaseFortify
Publication date: 2025-08-26
Last updated on: 2025-11-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| imagemagick | imagemagick | From 7.0.11-13 (inc) to 7.1.1-36 (inc) |
| imagemagick | imagemagick | From 7.0.11-13 (inc) to 7.1.1-36 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-369 | The product divides a value by zero. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-55212 is a vulnerability in ImageMagick's ThumbnailImage function triggered when the montage command's -geometry option is set to a colon (":"). This causes the GetGeometry() function to interpret the geometry string as zero width and height. Later, ThumbnailImage() attempts to divide by these zero dimensions when calculating scaling factors, causing a division by zero error that crashes the program (SIGFPE/abort). This results in a denial of service. The issue was fixed by replacing unsafe integer division with safe reciprocal multiplication and adding checks to handle zero or invalid sizes safely. [1, 2]
How can this vulnerability impact me? :
This vulnerability can cause ImageMagick to crash when processing certain malformed geometry strings, specifically when the geometry string is ":". The crash results in a denial of service, meaning that the application or service using ImageMagick could be interrupted or stopped unexpectedly. Since the attack can be triggered remotely without privileges or user interaction, it could be exploited to disrupt services relying on ImageMagick for image processing. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to trigger the crash using the vulnerable montage command with a geometry string set to a colon (":"). For example, running the command `./bin/magick montage -geometry : xc:white null:` will cause an immediate crash if the system is vulnerable. Monitoring for crashes or denial of service symptoms when this command or similar malformed geometry strings are used can help detect the vulnerability. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading ImageMagick to version 6.9.13-28, 7.1.2-2, or later, where the vulnerability has been patched. Additionally, avoid using the montage command with malformed geometry strings such as ":" or variants that result in zero dimensions. Implement input validation to reject such malformed geometry strings before processing. Monitoring and restricting access to the montage command can also reduce risk. [2, 1]