CVE-2025-57803
BaseFortify
Publication date: 2025-08-26
Last updated on: 2025-11-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| imagemagick | imagemagick | From 7.0.11-13 (inc) to 7.1.1-36 (inc) |
| imagemagick | imagemagick | From 7.0.11-13 (inc) to 7.1.1-36 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
| CWE-190 | The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a 32-bit integer overflow in the BMP encoder of ImageMagick's 32-bit build. It causes the calculation of bytes_per_line (stride) to overflow and become a very small value, while the encoder still writes 3 times the image width bytes per row for 24-bpp images. As a result, the row base pointer advances incorrectly, causing the first row to write beyond its allocated memory into adjacent heap memory with attacker-controlled data. This leads to heap corruption and can be exploited in image auto-conversion pipelines.
How can this vulnerability impact me? :
This vulnerability can lead to heap corruption, which is a powerful primitive for attackers. Exploiting it could allow an attacker to execute arbitrary code, cause a denial of service, or compromise the integrity and availability of systems that use vulnerable versions of ImageMagick for image processing.
What immediate steps should I take to mitigate this vulnerability?
Update ImageMagick to version 6.9.13-28 or later, or 7.1.2-2 or later, as these versions contain the patch that fixes the 32-bit integer overflow vulnerability in the BMP encoder.