CVE-2025-57807: ImageMagick BlobStream Forward-Seek Under-Allocation

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-09-05 · updated 2026-10-19
Weakness: CWE-122

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functions: SeekBlob(), which permits advancing the stream offset beyond the current end without increasing capacity, and WriteBlob(), which then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset ≫ extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 2⁶⁴ arithmetic wrap, external delegates, or policy settings are required. This is fixed in version 14.8.2.

Affected products

ImageMagick: before 6.9.13-29; from 7.0.0-0 before 7.1.2-3 — fixed in 6.9.13-29, 7.1.2-3

How to fix

Upgrade to a fixed version: ImageMagick 6.9.13-29, 7.1.2-3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-57807 or the next vulnerability affects your stack