BaseFortify

Publication date: 2025-12-02

Last updated on: 2026-06-23

Assigner: GitHub, Inc.

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-9 and 6.9.13-34, there is a vulnerability in ImageMagick’s Magick++ layer that manifests when Options::fontFamily is invoked with an empty string. Clearing a font family calls RelinquishMagickMemory on _drawInfo->font, freeing the font string but leaving _drawInfo->font pointing to freed memory while _drawInfo->family is set to that (now-invalid) pointer. Any later cleanup or reuse of _drawInfo->font re-frees or dereferences dangling memory. DestroyDrawInfo and other setters (Options::font, Image::font) assume _drawInfo->font remains valid, so destruction or subsequent updates trigger crashes or heap corruption. This vulnerability is fixed in 7.1.2-9 and 6.9.13-34.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-02

Last Modified

2026-06-23

Generated

2026-07-06

AI Q&A

2025-12-03

EPSS Evaluated

2026-07-05

NVD

CVE-2025-65955

Affected Vendors & Products

Vendor	Product	Version / Range
imagemagick	imagemagick	7.1.2-9
imagemagick	imagemagick	6.9.13-34
imagemagick	imagemagick	to 6.19.13-34 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-415	The product calls free() twice on the same memory address.
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability in ImageMagick's Magick++ layer occurs when the fontFamily option is set to an empty string. It causes the program to free memory related to the font string but leaves a pointer referencing that freed memory. Subsequent operations that use this pointer can cause crashes or heap corruption because they access invalid memory.

Impact Analysis

The vulnerability can lead to application crashes or heap corruption when ImageMagick processes images with certain font settings. This can cause denial of service or potentially allow attackers to exploit the memory corruption for further attacks.

Mitigation Strategies

Update ImageMagick to version 7.1.2-9 or later, or 6.9.13-34 or later, where this vulnerability is fixed.

Hi! I’m here to help you understand CVE-2025-65955. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70