cbcvebase.
CVE-2025-53014
published 2025-07-14

CVE-2025-53014: ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer…

PriorityP355critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.62%
45.7th percentile
ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue.

Affected

14 ranges
VendorProductVersion rangeFixed in
debianimagemagick< imagemagick 8:6.9.11.60+dfsg-1.6+deb12u4 (bookworm)imagemagick 8:6.9.11.60+dfsg-1.6+deb12u4 (bookworm)
imagemagickimagemagick< 7.1.2-07.1.2-0
imagemagickimagemagick< 6.9.13-266.9.13-26
imagemagickimagemagick>= 0 < 8:6.9.11.60+dfsg-1.3+deb11u68:6.9.11.60+dfsg-1.3+deb11u6
imagemagickimagemagick>= 0 < 8:6.9.11.60+dfsg-1.6+deb12u48:6.9.11.60+dfsg-1.6+deb12u4
imagemagickimagemagick>= 0 < 8:7.1.1.43+dfsg1-1+deb13u18:7.1.1.43+dfsg1-1+deb13u1
imagemagickimagemagick>= 0 < 8:7.1.1.47+dfsg1-28:7.1.1.47+dfsg1-2
imagemagickimagemagick>= 0 < 8:6.7.7.10-6ubuntu3.13+esm138:6.7.7.10-6ubuntu3.13+esm13
imagemagickimagemagick>= 0 < 8:6.8.9.9-7ubuntu5.16+esm128:6.8.9.9-7ubuntu5.16+esm12
imagemagickimagemagick>= 0 < 8:6.9.7.4+dfsg-16ubuntu6.15+esm48:6.9.7.4+dfsg-16ubuntu6.15+esm4
imagemagickimagemagick>= 0 < 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm28:6.9.10.23+dfsg-2.1ubuntu11.11+esm2
imagemagickimagemagick>= 0 < 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm28:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm2
imagemagickimagemagick>= 0 < 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm18:6.9.12.98+dfsg1-5.2ubuntu0.1~esm1
imagemagickimagemagick>= 7.0.0-0 < 7.1.2-07.1.2-0

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian3.7LOW
vendor_redhat3.7LOW
vendor_ubuntu3.7LOW
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.