CVE-2025-68469
Crash Vulnerability in ImageMagick TIFF Processing Causes Denial of Service
Publication date: 2025-12-18
Last updated on: 2025-12-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| imagemagick | imagemagick | 7.1.1-13 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-68469 is a heap-based buffer overflow vulnerability in ImageMagick versions up to 7.1.1-13. It occurs when processing a specially crafted TIFF file, causing the application to crash. This overflow happens in a heap-allocated buffer, which can lead to instability or denial of service. The issue was fixed in version 7.1.1-14. [1]
How can this vulnerability impact me? :
This vulnerability can cause ImageMagick to crash when processing malicious TIFF files, potentially leading to denial of service. Since it is a low severity heap-based buffer overflow, it primarily impacts application stability rather than allowing remote code execution or data breach. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to process a specially crafted TIFF file that triggers the heap-based buffer overflow. A proof-of-concept (PoC) TIFF file can be used with the command: `magick poc.tiff /dev/null`. If the ImageMagick application crashes during this operation, the system is vulnerable. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately upgrade ImageMagick to version 7.1.1-14 or later, where the issue has been fixed. Avoid processing untrusted or specially crafted TIFF files until the update is applied. [1]