CVE-2025-53014
published 2025-07-14CVE-2025-53014: ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer…
PriorityP355critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.62%
45.7th percentile
ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | imagemagick | < imagemagick 8:6.9.11.60+dfsg-1.6+deb12u4 (bookworm) | imagemagick 8:6.9.11.60+dfsg-1.6+deb12u4 (bookworm) |
| imagemagick | imagemagick | < 7.1.2-0 | 7.1.2-0 |
| imagemagick | imagemagick | < 6.9.13-26 | 6.9.13-26 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.3+deb11u6 | 8:6.9.11.60+dfsg-1.3+deb11u6 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.6+deb12u4 | 8:6.9.11.60+dfsg-1.6+deb12u4 |
| imagemagick | imagemagick | >= 0 < 8:7.1.1.43+dfsg1-1+deb13u1 | 8:7.1.1.43+dfsg1-1+deb13u1 |
| imagemagick | imagemagick | >= 0 < 8:7.1.1.47+dfsg1-2 | 8:7.1.1.47+dfsg1-2 |
| imagemagick | imagemagick | >= 0 < 8:6.7.7.10-6ubuntu3.13+esm13 | 8:6.7.7.10-6ubuntu3.13+esm13 |
| imagemagick | imagemagick | >= 0 < 8:6.8.9.9-7ubuntu5.16+esm12 | 8:6.8.9.9-7ubuntu5.16+esm12 |
| imagemagick | imagemagick | >= 0 < 8:6.9.7.4+dfsg-16ubuntu6.15+esm4 | 8:6.9.7.4+dfsg-16ubuntu6.15+esm4 |
| imagemagick | imagemagick | >= 0 < 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2 | 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm2 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm2 |
| imagemagick | imagemagick | >= 0 < 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm1 | 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm1 |
| imagemagick | imagemagick | >= 7.0.0-0 < 7.1.2-0 | 7.1.2-0 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian3.7LOW
vendor_redhat3.7LOW
vendor_ubuntu3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
imagemagick vulnerabilities
osv·2025-09-01·CVSS 9.8
CVE-2025-53014 [CRITICAL] imagemagick vulnerabilities
imagemagick vulnerabilities
It was discovered that ImageMagick did not properly process certain
format strings when interpreting image filenames. An attacker could
possibly use this issue to cause ImageMagick to crash, resulting in
a denial of service. (CVE-2025-53014)
It was discovered that ImageMagick did not properly process certain
format strings when interpreting image filenames. An attacker could
possibly use this issue to cause ImageMagick to consume resources,
resulting in a denial of service. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,
and Ubuntu 24.04 LTS. (CVE-2025-53019)
It was discovered that ImageMagick did not properly process certain
format strings when interpreting image filenames. An attacker could
possibly use this
OSV
ImageMagick has a Heap Buffer Overflow in InterpretImageFilename
osv·2025-08-25
CVE-2025-53014 [LOW] ImageMagick has a Heap Buffer Overflow in InterpretImageFilename
ImageMagick has a Heap Buffer Overflow in InterpretImageFilename
# Heap Buffer Overflow in InterpretImageFilename
## Summary
A heap buffer overflow was identified in the `InterpretImageFilename` function of ImageMagick. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`).
## Environment
- **OS**: Arch Linux (Linux gmkhost 6.14.2-arch1-1 # 1 SMP PREEMPT_DYNAMIC Thu, 10 Apr 2025 18:43:59 +0000 x86_64 GNU/Linux (GNU libc) 2.41)
- **Architecture**: x86_64
- **Compiler**: gcc (GCC) 15.1.1 20250425
## Reproduction
### Build Instructions
```bash
# Clone the repository
git clone https://github.com/ImageMagick/ImageMagick.git
cd ImageMagick
git reset --hard 8fff9b4f44d2e8b5cae2bd6db70930a144
GHSA
ImageMagick has a Heap Buffer Overflow in InterpretImageFilename
ghsa·2025-08-25
CVE-2025-53014 [LOW] CWE-125 ImageMagick has a Heap Buffer Overflow in InterpretImageFilename
ImageMagick has a Heap Buffer Overflow in InterpretImageFilename
# Heap Buffer Overflow in InterpretImageFilename
## Summary
A heap buffer overflow was identified in the `InterpretImageFilename` function of ImageMagick. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`).
## Environment
- **OS**: Arch Linux (Linux gmkhost 6.14.2-arch1-1 # 1 SMP PREEMPT_DYNAMIC Thu, 10 Apr 2025 18:43:59 +0000 x86_64 GNU/Linux (GNU libc) 2.41)
- **Architecture**: x86_64
- **Compiler**: gcc (GCC) 15.1.1 20250425
## Reproduction
### Build Instructions
```bash
# Clone the repository
git clone https://github.com/ImageMagick/ImageMagick.git
cd ImageMagick
git reset --hard 8fff9b4f44d2e8b5cae2bd6db70930a144
OSV
CVE-2025-53014: ImageMagick is free and open-source software used for editing and manipulating digital images
osv·2025-07-14·CVSS 9.8
CVE-2025-53014 [CRITICAL] CVE-2025-53014: ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue.
Ubuntu
ImageMagick vulnerabilities
vendor_ubuntu·2025-09-01·CVSS 3.7
CVE-2025-53019 [LOW] ImageMagick vulnerabilities
Title: ImageMagick vulnerabilities
Summary: Several security issues were fixed in ImageMagick.
It was discovered that ImageMagick did not properly process certain
format strings when interpreting image filenames. An attacker could
possibly use this issue to cause ImageMagick to crash, resulting in
a denial of service. (CVE-2025-53014)
It was discovered that ImageMagick did not properly process certain
format strings when interpreting image filenames. An attacker could
possibly use this issue to cause ImageMagick to consume resources,
resulting in a denial of service. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,
and Ubuntu 24.04 LTS. (CVE-2025-53019)
It was discovered that ImageMagick did not properly process certain
format strings whe
Red Hat
ImageMagick: ImageMagick Heap Buffer Overflow
vendor_redhat·2025-07-14·CVSS 3.7
CVE-2025-53014 [LOW] CWE-193 ImageMagick: ImageMagick Heap Buffer Overflow
ImageMagick: ImageMagick Heap Buffer Overflow
ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue.
A heap buffer overflow flaw has been discovered in ImageMagick. This issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product
Debian
CVE-2025-53014: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...
vendor_debian·2025·CVSS 3.7
CVE-2025-53014 [LOW] CVE-2025-53014: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...
ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue.
Scope: local
bookworm: resolved (fixed in 8:6.9.11.60+dfsg-1.6+deb12u4)
bullseye: resolved (fixed in 8:6.9.11.60+dfsg-1.3+deb11u6)
forky: resolved (fixed in 8:7.1.1.47+dfsg1-2)
sid: resolved (fixed in 8:7.1.1.47+dfsg1-2)
trixie: resolved (fixed in 8:7.1.1.43+dfsg1-1+deb13u1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-53014 ImageMagick: ImageMagick Heap Buffer Overflow [fedora-42]
bugzilla·2025-07-14·CVSS 9.8
CVE-2025-53014 [CRITICAL] CVE-2025-53014 ImageMagick: ImageMagick Heap Buffer Overflow [fedora-42]
CVE-2025-53014 ImageMagick: ImageMagick Heap Buffer Overflow [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from re
Bugzilla
CVE-2025-53014 ImageMagick: ImageMagick Heap Buffer Overflow [epel-9]
bugzilla·2025-07-14·CVSS 9.8
CVE-2025-53014 [CRITICAL] CVE-2025-53014 ImageMagick: ImageMagick Heap Buffer Overflow [epel-9]
CVE-2025-53014 ImageMagick: ImageMagick Heap Buffer Overflow [epel-9]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
FEDORA-EPEL-2026-2d971fc3b0 (ImageMagick-6.9.13.49-1.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-2d971fc3b0
---
FEDORA-EPEL-2026-fb9a9ab1e9 has bee
Bugzilla
CVE-2025-53014 ImageMagick: ImageMagick Heap Buffer Overflow [epel-10]
bugzilla·2025-07-14·CVSS 9.8
CVE-2025-53014 [CRITICAL] CVE-2025-53014 ImageMagick: ImageMagick Heap Buffer Overflow [epel-10]
CVE-2025-53014 ImageMagick: ImageMagick Heap Buffer Overflow [epel-10]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
FEDORA-EPEL-2026-2d971fc3b0 (ImageMagick-6.9.13.49-1.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-2d971fc3b0
---
FEDORA-EPEL-2026-fb9a9ab1e9 has be
Bugzilla
CVE-2025-53014 ImageMagick: ImageMagick Heap Buffer Overflow [epel-8]
bugzilla·2025-07-14·CVSS 9.8
CVE-2025-53014 [CRITICAL] CVE-2025-53014 ImageMagick: ImageMagick Heap Buffer Overflow [epel-8]
CVE-2025-53014 ImageMagick: ImageMagick Heap Buffer Overflow [epel-8]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
FEDORA-EPEL-2026-2d971fc3b0 (ImageMagick-6.9.13.49-1.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-2d971fc3b0
---
FEDORA-EPEL-2026-fb9a9ab1e9 has bee
2025-07-14
Published