CVE-2025-55154

HIGH EPSS 56.2%
Published Aug 13, 202510mo ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
High
Find Similar
Published Aug 13, 2025 10mo ago
Last Modified Jun 17, 2026 2w ago

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
56.2% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-190 Integer Overflow or Wraparound Numeric Error

Affected Products 2

VendorProductVersionRange
imagemagickimagemagick* <6.9.13-27
imagemagickimagemagick*≥7.0.0-0  –  <7.1.2-1

References 3

  • github.com https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp29-wxp5-wh82
    ExploitVendor Advisory
  • goo.gle https://goo.gle/bigsleep
    Issue Tracking
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.