CVE-2025-46393
In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled ...
In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).
- Record
CVE-2025-46393- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-131
- Updated
- 2026-11-02
EUVDEUVD-2025-12198
In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).
- Record
EUVD-2025-12198- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f57x-prr8-55vv
In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled ...
In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).
- Record
GHSA-f57x-prr8-55vv- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-131
- Updated
- 2026-11-02
NVD
In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).
- Record
CVE-2025-46393- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-131
- Updated
- 2026-11-02
OSV
In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).
- Record
CVE-2025-46393- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-131
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-46393
In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).
- Record
DEBIAN-CVE-2025-46393- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 11 moreShow less
OSVJLSEC-2026-915
In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled ...
In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).
- Record
JLSEC-2026-915- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2025-1498
ImageMagick security update
Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.
Security Fix(es):
In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.(CVE-2025-43965)
In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).(CVE-2025-46393)
- Record
OESA-2025-1498- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2025-1500
ImageMagick security update
Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.
Security Fix(es):
In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.(CVE-2025-43965)
In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).(CVE-2025-46393)
- Record
OESA-2025-1500- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2025-1501
ImageMagick security update
Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.
Security Fix(es):
In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.(CVE-2025-43965)
In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).(CVE-2025-46393)
- Record
OESA-2025-1501- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2025-1502
ImageMagick security update
Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.
Security Fix(es):
In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.(CVE-2025-43965)
In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).(CVE-2025-46393)
- Record
OESA-2025-1502- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-46393
In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).
- Record
UBUNTU-CVE-2025-46393- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVMGASA-2025-0141 No score
Updated imagemagick packages fix security vulnerabilities
In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used. (CVE-2025-43965) In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order). (CVE-2025-46393)
- Record
MGASA-2025-0141- Updated
- 2026-11-02
OSVSUSE-SU-2025:01464-1 No score
Security update for ImageMagick
This update for ImageMagick fixes the following issues:
- CVE-2025-43965: Fixed mishandling of image depth after SetQuantumFormat is used in MIFF image processing. (bsc#1241659)
- CVE-2025-46393: Fixed mishandling of packet_size leads to rendering of channels in arbitrary order in multispectral MIFF image processing. (bsc#1241658)
- Record
SUSE-SU-2025:01464-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02188-1 No score
Security update for ImageMagick
This update for ImageMagick fixes the following issues:
Security issues fixed:
- CVE-2025-43965: mishandling of image depth after SetQuantumFormat is used in MIFF image processing (bsc#1241659).
- CVE-2025-46393: mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing (bsc#1241658).
Other issues fixed:
- Restore SUSE specific hardening config policies that got lost in refactoring (bsc#1243622).
- Record
SUSE-SU-2025:02188-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:1464-1 No score
Security update for ImageMagick
This update for ImageMagick fixes the following issues:
- CVE-2025-43965: Fixed mishandling of image depth after SetQuantumFormat is used in MIFF image processing. (bsc#1241659)
- CVE-2025-46393: Fixed mishandling of packet_size leads to rendering of channels in arbitrary order in multispectral MIFF image processing. (bsc#1241658)
- Record
SUSE-SU-2025:1464-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:1488-1 No score
Security update for ImageMagick
This update for ImageMagick fixes the following issues:
- CVE-2025-43965: mishandling of image depth after SetQuantumFormat is used in MIFF image processing. (bsc#1241659)
- CVE-2025-46393: mishandling of packet_size leads to rendering of channels in arbitrary order in multispectral MIFF image processing. (bsc#1241658)
- Record
SUSE-SU-2025:1488-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
imagemagickDebian:13 |
before 8:7.1.1.43+dfsg1-1+deb13u1, plus listed versions 8:7.1.1.43+dfsg1-1 |
8:7.1.1.43+dfsg1-1+deb13u1 |
imagemagickDebian:14 |
before 8:7.1.1.46+dfsg1-1, plus listed versions 8:7.1.1.43+dfsg1-1 |
8:7.1.1.46+dfsg1-1 |
ImageMagick_jllJulia |
before 7.1.1047+0 | 7.1.1047+0 |
imagemagickMageia:9 From an advisory covering 2 CVEs |
before 7.1.1.29-1.1.mga9 | 7.1.1.29-1.1.mga9 |
imagemagickMageia:9 From an advisory covering 2 CVEs |
before 7.1.1.29-1.1.mga9.tainted | 7.1.1.29-1.1.mga9.tainted |
ImageMagickopenEuler:24.03-LTS-SP1 From an advisory covering 2 CVEs |
before 7.1.1.15-2.oe2403sp1 | 7.1.1.15-2.oe2403sp1 |
ImageMagickopenEuler:22.03-LTS-SP3 From an advisory covering 2 CVEs |
before 7.1.1.8-6.oe2203sp3 | 7.1.1.8-6.oe2203sp3 |
ImageMagickopenEuler:22.03-LTS-SP4 From an advisory covering 2 CVEs |
before 7.1.1.8-6.oe2203sp4 | 7.1.1.8-6.oe2203sp4 |
ImageMagickopenEuler:24.03-LTS From an advisory covering 2 CVEs |
before 7.1.1.15-2.oe2403 | 7.1.1.15-2.oe2403 |
ImageMagickSUSE:Linux Enterprise Module for Desktop Applications 15 SP7 From an advisory covering 2 CVEs |
before 7.1.0.9-150400.6.30.1 | 7.1.0.9-150400.6.30.1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ImageMagickSUSE:Linux Enterprise Module for Desktop Applications 15 SP7 From an advisory covering 2 CVEs |
before 7.1.1.43-150700.3.3.1 | 7.1.1.43-150700.3.3.1 |
ImageMagickSUSE:Linux Enterprise Module for Development Tools 15 SP7 From an advisory covering 2 CVEs |
before 7.1.1.43-150700.3.3.1 | 7.1.1.43-150700.3.3.1 |
ImageMagickSUSE:Linux Enterprise Module for Desktop Applications 15 SP6 From an advisory covering 2 CVEs |
before 7.1.0.9-150400.6.30.1 | 7.1.0.9-150400.6.30.1 |
ImageMagickSUSE:Linux Enterprise Module for Desktop Applications 15 SP6 From an advisory covering 2 CVEs |
before 7.1.1.21-150600.3.3.1 | 7.1.1.21-150600.3.3.1 |
ImageMagickSUSE:Linux Enterprise Module for Development Tools 15 SP6 From an advisory covering 2 CVEs |
before 7.1.1.21-150600.3.3.1 | 7.1.1.21-150600.3.3.1 |
ImageMagickopenSUSE:Leap 15.6 From an advisory covering 2 CVEs |
before 7.1.1.21-150600.3.3.1 | 7.1.1.21-150600.3.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-46393 is a low vulnerability (CVSS 2.9) in Imagemagick, published April 23, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in imagemagick 8:7.1.1.43+dfsg1-1+deb13u1.
References
github.com/ImageMagick/Website/blob/main/ChangeLog.md
nvd.nist.gov/vuln/detail/CVE-2025-46393
security-tracker.debian.org/tracker/CVE-2025-46393
Show 19 moreShow less
advisories.mageia.org/MGASA-2025-0141.html
bugs.mageia.org/show_bug.cgi?id=34225
lists.fedoraproject.org/archives/list/[email protected]/message/QGYTGMYA4MY32ZOTCKVGK6FI76RHFHY4
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1498
suse.com/support/update/announcement/2025/suse-su-202501464-1
bugzilla.suse.com/1241658
ubuntu.com/security/CVE-2025-46393
cve.org/CVERecord?id=CVE-2025-46393