What’s Vulnerable › Vulnerabilities

CVE-2020-25664

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-12-08 · updated 2026-06-17
• Weakness: CWE-122

Description

In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68.

Affected products

• Fedoraproject Fedora: 34
• ImageMagick: before 6.9.10-68; from 7.0.8 before 7.0.8-68 — fixed in 6.9.10-68, 7.0.8-68

How to fix

Upgrade to a fixed version: ImageMagick 6.9.10-68, 7.0.8-68. Check the vendor advisory for mitigations.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=1891605
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z3J6D7POCQYQKNVRDYLTTPM5SQC3WVTR/
• https://bugzilla.redhat.com/show_bug.cgi?id=1891605
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z3J6D7POCQYQKNVRDYLTTPM5SQC3WVTR/

Get alerted when CVE-2020-25664 or the next vulnerability affects your stack