{"id":"CVE-2025-46393","aliases":["DEBIAN-CVE-2025-46393","EUVD-2025-12198","GHSA-f57x-prr8-55vv","JLSEC-2026-915","MGASA-2025-0141","OESA-2025-1498","OESA-2025-1500","OESA-2025-1501","OESA-2025-1502","SUSE-SU-2025:01464-1","SUSE-SU-2025:02188-1","SUSE-SU-2025:1464-1","SUSE-SU-2025:1488-1","UBUNTU-CVE-2025-46393"],"status":"published","title":"In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled ...","description":"In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).","severity":{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00421,"percentile":0.36736,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-131"],"published":"2025-04-23T00:00:00Z","modified":"2026-10-28T10:45:27Z","fixes":[{"ecosystem":"Debian:13","package":"imagemagick","fixed_in":["8:7.1.1.43+dfsg1-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"imagemagick","fixed_in":["8:7.1.1.46+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"ImageMagick_jll","fixed_in":["7.1.1047+0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:7.1.1.43+dfsg1-1+deb13u1"}]}],"versions":["8:7.1.1.43+dfsg1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:7.1.1.46+dfsg1-1"}]}],"versions":["8:7.1.1.43+dfsg1-1"]},{"source":"osv","ecosystem":"Julia","package":"ImageMagick_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.1.1047+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1.29-1.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1.29-1.1.mga9.tainted"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1.15-2.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1.8-6.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1.8-6.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1.15-2.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1.43-150700.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1.43-150700.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1.21-150600.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1.21-150600.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1.21-150600.3.3.1"}]}],"bundled":2}],"products":[{"vendor":"imagemagick","product":"imagemagick"}],"references":[{"url":"https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-44---2025-02-22","tags":["Release Notes","web","report"]},{"url":"https://github.com/ImageMagick/ImageMagick/commit/81ac8a0d2eb21739842ed18c48c7646b7eef65b8","tags":["Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46393","tags":["advisory","web"]},{"url":"https://github.com/advisories/GHSA-f57x-prr8-55vv","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46393.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-46393","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0141.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34225","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGYTGMYA4MY32ZOTCKVGK6FI76RHFHY4/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1498","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43965","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1500","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1501","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1502","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501464-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1241658","tags":["report"]},{"url":"https://bugzilla.suse.com/1241659","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-43965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46393","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502188-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243622","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251464-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251488-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-46393","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-46393","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-46393","description":"In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).","status":"published","published":"2025-04-23T00:00:00Z","modified":"2025-04-23T15:17:20.473Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-131"],"updated_at":"2026-11-02T14:32:36.706507Z"}],"euvd":[{"id":"EUVD-2025-12198","description":"In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).","status":"published","published":"2025-04-23T00:00:00Z","modified":"2025-04-23T15:17:20Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T20:52:13.655516Z"}],"ghsa":[{"id":"GHSA-f57x-prr8-55vv","title":"In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled ...","description":"In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).","status":"published","published":"2025-04-23T15:30:57Z","modified":"2025-04-23T15:31:07Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-131"],"updated_at":"2026-11-02T15:02:00.180386Z"}],"nvd":[{"id":"CVE-2025-46393","description":"In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).","status":"published","published":"2025-04-23T15:16:01.06Z","modified":"2026-06-17T09:26:20.19Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-131"],"updated_at":"2026-11-02T14:11:01.507281Z"}],"osv":[{"id":"CVE-2025-46393","description":"In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).","status":"published","published":"2025-04-23T00:00:00Z","modified":"2026-10-28T10:45:27.028825046Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-131"],"updated_at":"2026-11-02T15:44:49.707645Z"},{"id":"DEBIAN-CVE-2025-46393","description":"In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).","status":"published","published":"2025-04-23T15:16:01.06Z","modified":"2026-09-01T20:05:52.675054218Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"JLSEC-2026-915","title":"In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled ...","description":"In multispectral MIFF image processing in ImageMagick before 7.1.1-44, `packet_size` is mishandled (related to the rendering of all channels in an arbitrary order).","status":"published","published":"2026-07-30T16:02:27.435Z","modified":"2026-07-30T18:35:41.198753779Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:19.003546Z"},{"id":"OESA-2025-1498","title":"ImageMagick security update","description":"Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.\r\n\r\nSecurity Fix(es):\n\nIn MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.(CVE-2025-43965)\n\nIn multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).(CVE-2025-46393)","status":"published","published":"2025-05-09T11:08:35Z","modified":"2026-08-18T01:17:52.382863008Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1500","title":"ImageMagick security update","description":"Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.\r\n\r\nSecurity Fix(es):\n\nIn MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.(CVE-2025-43965)\n\nIn multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).(CVE-2025-46393)","status":"published","published":"2025-05-09T11:08:35Z","modified":"2026-08-18T01:17:57.6035893Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1501","title":"ImageMagick security update","description":"Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.\r\n\r\nSecurity Fix(es):\n\nIn MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.(CVE-2025-43965)\n\nIn multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).(CVE-2025-46393)","status":"published","published":"2025-05-09T11:08:35Z","modified":"2026-08-18T01:17:57.727122476Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1502","title":"ImageMagick security update","description":"Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.\r\n\r\nSecurity Fix(es):\n\nIn MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.(CVE-2025-43965)\n\nIn multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).(CVE-2025-46393)","status":"published","published":"2025-05-09T11:08:35Z","modified":"2026-08-18T01:17:57.546405581Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"UBUNTU-CVE-2025-46393","description":"In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).","status":"withdrawn","published":"2025-04-23T15:16:00Z","modified":"2026-01-20T18:48:07.024182Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"MGASA-2025-0141","title":"Updated imagemagick packages fix security vulnerabilities","description":"In MIFF image processing in ImageMagick before 7.1.1-44, image depth is\nmishandled after SetQuantumFormat is used. (CVE-2025-43965)\nIn multispectral MIFF image processing in ImageMagick before 7.1.1-44,\npacket_size is mishandled (related to the rendering of all channels in\nan arbitrary order). (CVE-2025-46393)\n","status":"published","published":"2025-05-01T06:51:10Z","modified":"2026-04-16T04:43:12.195541479Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"SUSE-SU-2025:01464-1","title":"Security update for ImageMagick","description":"This update for ImageMagick fixes the following issues:\n\n- CVE-2025-43965: Fixed mishandling of image depth after SetQuantumFormat is used in MIFF image processing. (bsc#1241659)\n- CVE-2025-46393: Fixed mishandling of packet_size leads to rendering of channels in arbitrary order in multispectral MIFF image processing. (bsc#1241658)\n","status":"published","published":"2025-05-29T09:33:48Z","modified":"2026-03-23T04:46:16.195217Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:02188-1","title":"Security update for ImageMagick","description":"This update for ImageMagick fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2025-43965: mishandling of image depth after SetQuantumFormat is used in MIFF image processing (bsc#1241659).\n- CVE-2025-46393: mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image\n  processing (bsc#1241658).\n\nOther issues fixed:\n  \n- Restore SUSE specific hardening config policies that got lost in refactoring (bsc#1243622).\n","status":"published","published":"2025-07-01T11:48:28Z","modified":"2026-03-23T04:46:28.388985Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:1464-1","title":"Security update for ImageMagick","description":"This update for ImageMagick fixes the following issues:\n\n- CVE-2025-43965: Fixed mishandling of image depth after SetQuantumFormat is used in MIFF image processing. (bsc#1241659)\n- CVE-2025-46393: Fixed mishandling of packet_size leads to rendering of channels in arbitrary order in multispectral MIFF image processing. (bsc#1241658)\n","status":"published","published":"2025-05-05T18:49:06Z","modified":"2026-03-23T04:47:05.511168Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:1488-1","title":"Security update for ImageMagick","description":"This update for ImageMagick fixes the following issues:\n\n- CVE-2025-43965: mishandling of image depth after SetQuantumFormat is used in MIFF image processing. (bsc#1241659)\n- CVE-2025-46393: mishandling of packet_size leads to rendering of channels in arbitrary order in multispectral\n  MIFF image processing. (bsc#1241658)\n","status":"published","published":"2025-05-06T10:57:22Z","modified":"2026-03-23T04:48:49.691246Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}