CVE-2025-57807

Reporter: Lumina Mescuwa
Product: ImageMagick 7 (MagickCore)
Component: MagickCore/blob.c (Blob I/O - BlobStream)
Tested: 7.1.2-0 (source tag) and 7.1.2-1 (Homebrew), macOS arm64, clang-17, Q16-HDRI
Impact: Heap out-of-bounds WRITE (attacker-controlled bytes at attacker-chosen offset) → memory corruption; potential code execution

Executive Summary

For memory-backed blobs (BlobStream), SeekBlob() permits advancing the stream offset beyond the current end without increasing capacity. The subsequent WriteBlob() then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset ≫ extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 2⁶⁴ arithmetic wrap, external delegates, or policy settings are required.

Affected Scope

• Versions confirmed: 7.1.2-0, 7.1.2-1

• Architectures: Observed on macOS arm64; architecture-agnostic on LP64

• Paths: MagickCore blob subsystem — BlobStream (SeekBlob() and WriteBlob()).

• Not required: External delegates; special policies; integer wraparound

Technical Root Cause

Types (LP64):
offset: MagickOffsetType (signed 64-bit)
extent/length/quantum: size_t (unsigned 64-bit)
data: unsigned char*

Contract mismatch:

• SeekBlob() (BlobStream) updates offset to arbitrary positions, including past end, without capacity adjustment.

• WriteBlob() tests offset + length >= extent and grows by length + quantum, doubles quantum, reallocates to extent + 1, then:

  q = data + (size_t)offset;
  memmove(q, src, length);
  

  There is no guarantee that extent ≥ offset + length post-growth. With offset ≫ extent, q is beyond the allocation.

Wrap-free demonstration:
Initialize extent=1, write one byte (offset=1), seek to 0x10000000 (256 MiB), then write 3–4 bytes. Growth remains << offset + length; the copy overruns the heap buffer.

Exploitability & Reachability

• Primitive: Controlled bytes written at a controlled displacement from the buffer base.

• Reachability: Any encode-to-memory flow that forward-seeks prior to writing (e.g., header back-patching, reserved-space strategies). Even if current encoders/writers avoid this, the API contract permits it, thus creating a latent sink for first- or third-party encoders/writers.

• Determinism: Once a forward seek past end occurs, the first subsequent write reliably corrupts memory.

Impact Assessment

• Integrity: High - adjacent object/metadata overwrite plausible.

• Availability: High - reliably crashable (ASan and non-ASan).

• Confidentiality: High - Successful exploitation to RCE allows the attacker to read all data accessible by the compromised process.

• RCE plausibility: Typical of heap OOB writes in long-lived image services; allocator/layout dependent.

CVSS v3.1 Rationale (9.8)

• AV:N / PR:N / UI:N - server-side image processing is…

Reporter: Lumina Mescuwa Product: ImageMagick 7 (MagickCore) Component: MagickCore/blob.c (Blob I/O - BlobStream) Tested: 7.1.2-0 (source tag) and 7.1.2-1 (Homebrew), macOS arm64, clang-17, Q16-HDRI Impact: Heap out-of-bounds WRITE (attacker-controlled bytes at attacker-chosen offset) → memory corruption; potential code execution

Executive Summary

For memory-backed blobs (BlobStream), SeekBlob() permits advancing the stream offset beyond the current end without increasing capacity. The subsequent WriteBlob() then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset ≫ extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 2⁶⁴ arithmetic wrap, external delegates, or policy settings are required.

Affected Scope

• Versions confirmed: 7.1.2-0, 7.1.2-1

• Architectures: Observed on macOS arm64; architecture-agnostic on LP64

• Paths: MagickCore blob subsystem — BlobStream (SeekBlob() and WriteBlob()).

• Not required: External delegates; special policies; integer wraparound

Technical Root Cause

Types (LP64): offset: MagickOffsetType (signed 64-bit) extent/length/quantum: size_t (unsigned 64-bit) data: unsigned char*

Contract mismatch:

• SeekBlob() (BlobStream) updates offset to arbitrary positions, including past end, without capacity adjustment.

• WriteBlob() tests offset + length >= extent and grows by length + quantum, doubles quantum, reallocates to extent + 1, then:

  q = data + (size_t)offset;
  memmove(q, src, length);
  

  There is no guarantee that extent ≥ offset + length post-growth. With offset ≫ extent, q is beyond the allocation.

Wrap-free demonstration: Initialize extent=1, write one byte (offset=1), seek to 0x10000000 (256 MiB), then write 3–4 bytes. Growth remains << offset + length; the copy overruns the heap buffer.

Exploitability & Reachability

• Primitive: Controlled bytes written at a controlled displacement from the buffer base.

• Reachability: Any encode-to-memory flow that forward-seeks prior to writing (e.g., header back-patching, reserved-space strategies). Even if current encoders/writers avoid this, the API contract permits it, thus creating a latent sink for first- or third-party encoders/writers.

• Determinism: Once a forward seek past end occurs, the first subsequent write reliably corrupts memory.

Impact Assessment

• Integrity: High - adjacent object/metadata overwrite plausible.

• Availability: High - reliably crashable (ASan and non-ASan).

• Confidentiality: High - Successful exploitation to RCE allows the attacker to read all data accessible by the compromised process.

• RCE plausibility: Typical of heap OOB writes in long-lived image services; allocator/layout dependent.

CVSS v3.1 Rationale (9.8)

• AV:N / PR:N / UI:N - server-side image processing is commonly network-reachable without auth or…

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functions: SeekBlob(), which permits advancing the stream offset beyond the current end without increasing capacity, and WriteBlob(), which then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset ≫ extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 2⁶⁴ arithmetic wrap, external delegates, or policy settings are required. This is fixed in version 14.8.2.(CVE-2025-57807)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functions: SeekBlob(), which permits advancing the stream offset beyond the current end without increasing capacity, and WriteBlob(), which then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset ≫ extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 2⁶⁴ arithmetic wrap, external delegates, or policy settings are required. This is fixed in version 14.8.2.(CVE-2025-57807)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functions: SeekBlob(), which permits advancing the stream offset beyond the current end without increasing capacity, and WriteBlob(), which then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset ≫ extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 2⁶⁴ arithmetic wrap, external delegates, or policy settings are required. This is fixed in version 14.8.2.(CVE-2025-57807)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, ImageMagick is vulnerable to heap-buffer overflow read around the handling of images with separate alpha channels when performing image magnification in ReadOneMNGIMage. This can likely be used to leak subsequent memory contents into the output image. This issue has been patched in version 7.1.2-1.(CVE-2025-55004)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, when preparing to transform from Log to sRGB colorspaces, the logmap construction fails to handle cases where the reference-black or reference-white value is larger than 1024. This leads to corrupting memory beyond the end of the allocated logmap buffer. This issue has been patched in version 7.1.2-1.(CVE-2025-55005)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1.(CVE-2025-55154)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1.(CVE-2025-55160)

A vulnerability classified as problematic was found in ImageMagick up to 6.9.13-27/7.1.2-1 (Image Processing Software).The manipulation of the argument width/height with an unknown input leads to a unknown weakness. The CWE definition for the vulnerability is CWE-369. The product divides a value by zero.As an impact it is known to affect availability.Upgrading to version 6.9.13-28 or 7.1.2-2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 5f0bcf986b8b5e90567750d31a37af502b73f2af is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-55212)

A vulnerability was found in ImageMagick up to 6.9.13-27/7.1.2-1 on 32-bit (Image Processing Software). It has been rated as critical.Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().Impacted is confidentiality, integrity, and availability.Upgrading to version 6.9.13-28 or 7.1.2-2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 2c55221f4d38193adcb51056c14cf238fbcc35d7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-57803)

ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functions: SeekBlob(), which permits advancing the stream offset beyond the current end without increasing capacity, and WriteBlob(), which then expands by quantum + length (amortized) instead of offset + length, and copies to data +…

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functions: SeekBlob(), which permits advancing the stream offset beyond the current end without increasing capacity, and WriteBlob(), which then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset ≫ extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 2⁶⁴ arithmetic wrap, external delegates, or policy settings are required. This is fixed in version 14.8.2.(CVE-2025-57807)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functions: SeekBlob(), which permits advancing the stream offset beyond the current end without increasing capacity, and WriteBlob(), which then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset ≫ extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 2⁶⁴ arithmetic wrap, external delegates, or policy settings are required. This is fixed in version 14.8.2.(CVE-2025-57807)

ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functions: SeekBlob(), which permits advancing the stream offset beyond the current end without increasing capacity, and WriteBlob(), which then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset ≫ extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 2⁶⁴ arithmetic wrap, external delegates, or policy settings are required. This is fixed in version 14.8.2.

• CVE-2025-53101: fix heap OOB write in BlobStream
• CVE-2025-57807: fix stack overflow through vsnprintf()

• SECURITY UPDATE: heap out-of-bounds write in BlobStream (WriteBlob)
  • debian/patches/CVE-2025-57807.patch: enforce extent ≥ offset + length when forward-seeking before writes in MagickCore/blob.c
  • CVE-2025-57807

• SECURITY UPDATE: heap out-of-bounds write in BlobStream (WriteBlob)
  • debian/patches/CVE-2025-57807.patch: enforce extent ≥ offset + length when forward-seeking before writes in MagickCore/blob.c
  • CVE-2025-57807

• SECURITY UPDATE: heap out-of-bounds write in BlobStream (WriteBlob)
  • debian/patches/CVE-2025-57807.patch: enforce extent ≥ offset + length when forward-seeking before writes in MagickCore/blob.c
  • CVE-2025-57807

• CVE-2025-57807: heap buffer overflow in WriteBlobStream and WriteBlob via incorrect extent calculation when offset exceeds current capacity

• CVE-2025-57807: heap buffer overflow in WriteBlobStream and WriteBlob via incorrect extent calculation when offset exceeds current capacity

• CVE-2025-57807: heap buffer overflow in WriteBlobStream and WriteBlob via incorrect extent calculation when offset exceeds current capacity

• SECURITY UPDATE: fix vulnerability in image handling
  • debian/patches/CVE-2025-53101.patch: fix vulnerability in image handling
  • CVE-2025-53101
• SECURITY UPDATE: fix vulnerability in image handling
  • debian/patches/CVE-2025-53014.patch: fix vulnerability in image handling
  • CVE-2025-53014
• SECURITY UPDATE: fix heap-based buffer overflow in blob handling
  • debian/patches/CVE-2025-57807.patch: fix heap-based buffer overflow in blob handling
  • CVE-2025-57807
• SECURITY UPDATE: fix heap-based buffer overflow in XBM coder
  • debian/patches/CVE-2026-23876.patch: fix heap-based buffer overflow in XBM coder
  • CVE-2026-23876
• SECURITY UPDATE: fix buffer overflow in SUN coder
  • debian/patches/CVE-2026-25897.patch: fix buffer overflow in SUN coder
  • CVE-2026-25897
• SECURITY UPDATE: fix buffer overflow in PCD coder
  • debian/patches/CVE-2026-26284.patch: fix buffer overflow in PCD coder
  • CVE-2026-26284
• SECURITY UPDATE: fix vulnerability in MSL coder
  • debian/patches/CVE-2026-25968.patch: fix vulnerability in MSL coder
  • CVE-2026-25968
• SECURITY UPDATE: fix buffer overflow in YUV coder
  • debian/patches/CVE-2026-25986.patch: fix buffer overflow in YUV coder
  • CVE-2026-25986
• SECURITY UPDATE: fix buffer overflow in MAP coder
  • debian/patches/CVE-2026-25987.patch: fix buffer overflow in MAP coder
  • CVE-2026-25987
• SECURITY UPDATE: fix buffer overflow in UIL and XPM coders
  • debian/patches/CVE-2026-25898.patch: fix buffer overflow in UIL and XPM coders
  • CVE-2026-25898
• SECURITY UPDATE: fix heap-use-after-free in MSL coder
  • debian/patches/CVE-2026-25983.patch: fix heap-use-after-free in MSL coder
  • CVE-2026-25983
• SECURITY UPDATE: fix stack overflow via infinite recursion in MSL, SVG, and draw handling
  • debian/patches/CVE-2026-25971.patch: fix stack overflow via infinite recursion in MSL, SVG, and draw handling
  • CVE-2026-25971

These are all security issues fixed in the ImageMagick-7.1.2.3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for ImageMagick fixes the following issues:

• CVE-2025-62594: unsigned underflow and division-by-zero can lead to OOB pointer arithmetic and process crash (bsc#1252749).
• CVE-2025-57807: BlobStream Forward-Seek Under-Allocation (bsc#1249362).
• CVE-2025-62171: incomplete fix for integer overflow in BMP Decoder (bsc#1252282).
• CVE-2025-55298: format string bug vulnerability can lead to heap overflow (bsc#1248780).
• CVE-2025-57803: 32-bit integer overflow can lead to heap out-of-bounds (OOB) write (bsc#1248784).
• CVE-2025-55212: division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to montage -geometry (bsc#1248767).

Root has patched CVE-2025-57807 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available.

This update for ImageMagick fixes the following issues:

• CVE-2025-57807: heap out-of-bounds�write�can lead to memory corruption (bsc#1249362).

This update for ImageMagick fixes the following issues:

• CVE-2025-57807: heap out-of-bounds�write�can lead to memory corruption (bsc#1249362).

This update for ImageMagick fixes the following issues:

• CVE-2025-57807: heap out-of-bounds�write�can lead to memory corruption (bsc#1249362).

This update for ImageMagick fixes the following issues:

• CVE-2025-62594: unsigned underflow and division-by-zero can lead to OOB pointer arithmetic and process crash (bsc#1252749).
• CVE-2025-57807: BlobStream Forward-Seek Under-Allocation (bsc#1249362).
• CVE-2025-62171: incomplete fix for integer overflow in BMP Decoder (bsc#1252282).
• CVE-2025-55298: format string bug vulnerability can lead to heap overflow (bsc#1248780).
• CVE-2025-57803: 32-bit integer overflow can lead to heap out-of-bounds (OOB) write (bsc#1248784).
• CVE-2025-55212: division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to montage -geometry (bsc#1248767).

It was discovered that ImageMagick did not properly handle memory when performing magnified size calculations. An attacker could possibly use this issue to cause ImageMagick to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-55154)

Woojin Park, Hojun Lee, Youngin Won, and Siyeon Han discovered that ImageMagick incorrectly handled creating thumbnail images for certain dimensions. An attacker could possibly use this issue to cause ImageMagick to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2025-55212)

Lumina Mescuwa discovered that ImageMagick did not properly handle cloning splay trees in the MagickCore library. An attacker could possibly use this issue to cause sanitized builds of ImageMagick to crash, resulting in a denial of service. (CVE-2025-55160)

Lumina Mescuwa discovered that ImageMagick did not properly handle memory. An attacker could possibly use this issue to cause ImageMagick to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-57807)