What’s Vulnerable › Vulnerabilities

CVE-2025-53015: ImageMagick has XMP profile write that triggers hang due to unbounded loop

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-07-14 · updated 2026-06-17
• Weakness: CWE-835

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0, infinite lines occur when writing during a specific XMP file conversion command. Version 7.1.2-0 fixes the issue.

Affected products

• ImageMagick: from 7.1.1-7 before 7.1.2-0 — fixed in 7.1.2-0

How to fix

Upgrade to a fixed version: ImageMagick 7.1.2-0. Check the vendor advisory for mitigations.

References

• https://drive.google.com/file/d/1iegkwlTjqnJTtM4XkiheYsjKsC6pxtId/view?usp=sharing
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vmhh-8rxq-fp9g
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vmhh-8rxq-fp9g

Get alerted when CVE-2025-53015 or the next vulnerability affects your stack