CVE-2025-43965

In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.(CVE-2025-43965)

In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).(CVE-2025-46393)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.(CVE-2025-43965)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.(CVE-2025-43965)

In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).(CVE-2025-46393)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.(CVE-2025-43965)

In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).(CVE-2025-46393)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.(CVE-2025-43965)

In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).(CVE-2025-46393)

In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.

• SECURITY UPDATE: image depth mishandled after SetQuantumFormat in the MIFF reader (out-of-bounds read on crafted image)
  • debian/patches/CVE-2025-43965.patch: update image->depth from the quantum format's depth after SetQuantumFormat() in ReadMIFFImage() in coders/miff.c
  • CVE-2025-43965

• SECURITY UPDATE: heap corruption in MIFF reader via stale image->depth
  • debian/patches/CVE-2025-43965.patch: refresh image->depth from quantum_info->depth after SetQuantumFormat in coders/miff.c
  • CVE-2025-43965

• CVE-2025-43965: fix incorrect buffer size calculation (CWE-131) in the MIFF decoder caused by image depth not being resynchronized after SetQuantumFormat

• CVE-2025-43965: fix incorrect buffer size calculation (CWE-131) in the MIFF decoder caused by image depth not being resynchronized after SetQuantumFormat

• CVE-2025-43965: fix incorrect buffer size calculation (CWE-131) in the MIFF decoder caused by image depth not being resynchronized after SetQuantumFormat

• SECURITY UPDATE: memory leak in the JNG encoder when opening the alpha blob fails
  • debian/patches/CVE-2026-61866.patch: destroy the cloned jpeg_image and jpeg_image_info before raising the writer exception in WriteOneJNGImage() in coders/png.c
  • CVE-2026-61866

• SECURITY UPDATE: TIM coder integer overflow on 32-bit
  • debian/patches/CVE-2025-66628.patch: bounds check in coders/tim.c
  • CVE-2025-66628
• SECURITY UPDATE: PCD coder infinite loop on short read
  • debian/patches/CVE-2026-24485.patch: PCDGetBits guard in coders/pcd.c plus EOFBlob-based Sync-search / main-loop guards backported from upstream ecbccb6fe4b2 so the fix survives the size_t bits underflow on repeated short reads
  • CVE-2026-24485

In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used. (CVE-2025-43965) In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order). (CVE-2025-46393)

This update for ImageMagick fixes the following issues:

• CVE-2025-43965: Fixed mishandling of image depth after SetQuantumFormat is used in MIFF image processing. (bsc#1241659)
• CVE-2025-46393: Fixed mishandling of packet_size leads to rendering of channels in arbitrary order in multispectral MIFF image processing. (bsc#1241658)

This update for ImageMagick fixes the following issues:

Security issues fixed:

• CVE-2025-43965: mishandling of image depth after SetQuantumFormat is used in MIFF image processing (bsc#1241659).
• CVE-2025-46393: mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing (bsc#1241658).

Other issues fixed:

• Restore SUSE specific hardening config policies that got lost in refactoring (bsc#1243622).

This update for ImageMagick fixes the following issues:

• CVE-2025-43965: Fixed mishandling of image depth after SetQuantumFormat is used in MIFF image processing. (bsc#1241659)
• CVE-2025-46393: Fixed mishandling of packet_size leads to rendering of channels in arbitrary order in multispectral MIFF image processing. (bsc#1241658)

This update for ImageMagick fixes the following issues:

• CVE-2025-43965: mishandling of image depth after SetQuantumFormat is used in MIFF image processing. (bsc#1241659)
• CVE-2025-46393: mishandling of packet_size leads to rendering of channels in arbitrary order in multispectral MIFF image processing. (bsc#1241658)

This update for ImageMagick fixes the following issues:

• CVE-2025-43965: mishandling of image depth after SetQuantumFormat is used in MIFF image processing. (bsc#1241659)

It was discovered that ImageMagick incorrectly handled image depth values when processing MIFF image files. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2025-43965)

It was discovered that ImageMagick incorrectly processed SVG images and MSL files. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-68618)

It was discovered that ImageMagick incorrectly handled memory when converting MVG files. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-69204)