ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functions: SeekBlob(), which permits advancing the stream offset beyond the current end without increasing capacity, and WriteBlob(), which then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset ≫ extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 2⁶⁴ arithmetic wrap, external delegates, or policy settings are required. This is fixed in version 14.8.2.
References
| Link | Resource |
|---|---|
| https://github.com/ImageMagick/ImageMagick/commit/077a417a19a5ea8c85559b602754a5b928eef23e | Patch |
| https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6-hqfg | Exploit Mitigation Vendor Advisory |
| https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6-hqfg | Exploit Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
10 Sep 2025, 15:31
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Imagemagick
Imagemagick imagemagick |
|
| CPE | cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* | |
| References | () https://github.com/ImageMagick/ImageMagick/commit/077a417a19a5ea8c85559b602754a5b928eef23e - Patch | |
| References | () https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6-hqfg - Exploit, Mitigation, Vendor Advisory |
08 Sep 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6-hqfg - |
05 Sep 2025, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-05 22:15
Updated : 2025-09-10 15:31
NVD link : CVE-2025-57807
Mitre link : CVE-2025-57807
CVE.ORG link : CVE-2025-57807
JSON object : View
Products Affected
imagemagick
- imagemagick