What’s Vulnerable › Vulnerabilities

CVE-2025-55154: ImageMagick: integer overflows in MNG magnification

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-08-13 · updated 2026-06-17
• Weakness: CWE-190

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1.

Affected products

• ImageMagick: before 6.9.13-27; from 7.0.0-0 before 7.1.2-1 — fixed in 6.9.13-27, 7.1.2-1

How to fix

Upgrade to a fixed version: ImageMagick 6.9.13-27, 7.1.2-1. Check the vendor advisory for mitigations.

References

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp29-wxp5-wh82
• https://goo.gle/bigsleep
• https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html

Get alerted when CVE-2025-55154 or the next vulnerability affects your stack