CVE-2025-55212
published 2025-08-26CVE-2025-55212: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.85%
54.1th percentile
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (":") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | imagemagick | < imagemagick 8:6.9.11.60+dfsg-1.6+deb12u4 (bookworm) | imagemagick 8:6.9.11.60+dfsg-1.6+deb12u4 (bookworm) |
| imagemagick | imagemagick | < 7.1.2-2 | 7.1.2-2 |
| imagemagick | imagemagick | < 6.9.13-28 | 6.9.13-28 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.3+deb11u6 | 8:6.9.11.60+dfsg-1.3+deb11u6 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.6+deb12u4 | 8:6.9.11.60+dfsg-1.6+deb12u4 |
| imagemagick | imagemagick | >= 0 < 8:7.1.1.43+dfsg1-1+deb13u2 | 8:7.1.1.43+dfsg1-1+deb13u2 |
| imagemagick | imagemagick | >= 0 < 8:7.1.2.3+dfsg1-1 | 8:7.1.2.3+dfsg1-1 |
| imagemagick | imagemagick | >= 0 < 8:6.7.7.10-6ubuntu3.13+esm14 | 8:6.7.7.10-6ubuntu3.13+esm14 |
| imagemagick | imagemagick | >= 0 < 8:6.8.9.9-7ubuntu5.16+esm13 | 8:6.8.9.9-7ubuntu5.16+esm13 |
| imagemagick | imagemagick | >= 0 < 8:6.9.7.4+dfsg-16ubuntu6.15+esm5 | 8:6.9.7.4+dfsg-16ubuntu6.15+esm5 |
| imagemagick | imagemagick | >= 0 < 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm3 | 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm3 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm3 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm3 |
| imagemagick | imagemagick | >= 0 < 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm2 | 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm2 |
| imagemagick | imagemagick | >= 7.0.0-0 < 7.1.2-2 | 7.1.2-2 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian3.7LOW
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
ImageMagick vulnerabilities
vendor_ubuntu·2025-09-18·CVSS 8.8
CVE-2025-55154 [HIGH] ImageMagick vulnerabilities
Title: ImageMagick vulnerabilities
Summary: Several security issues were fixed in ImageMagick.
It was discovered that ImageMagick did not properly handle memory when
performing magnified size calculations. An attacker could possibly use this
issue to cause ImageMagick to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2025-55154)
Woojin Park, Hojun Lee, Youngin Won, and Siyeon Han discovered that
ImageMagick incorrectly handled creating thumbnail images for certain
dimensions. An attacker could possibly use this issue to cause ImageMagick
to crash, resulting in a denial of service. This issue only affected Ubuntu
24.04 LTS. (CVE-2025-55212)
Lumina Mescuwa discovered that ImageMagick did not properly handle cloning
splay trees in the MagickCore library.
Red Hat
ImageMagick: ImageMagick crash on crafted input
vendor_redhat·2025-08-26·CVSS 3.7
CVE-2025-55212 [LOW] CWE-369 ImageMagick: ImageMagick crash on crafted input
ImageMagick: ImageMagick crash on crafted input
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (":") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.
A logic error leading to a program crash has been discovered in ImageMagick. In affected versions passing a geometry string containing only a colon (":") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SI
Debian
CVE-2025-55212: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...
vendor_debian·2025·CVSS 3.7
CVE-2025-55212 [LOW] CVE-2025-55212: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (":") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.
Scope: local
bookworm: resolved (fixed in 8:6.9.11.60+dfsg-1.6+deb12u4)
bullseye: resolved (fixed in 8:6.9.11.60+dfsg-1.3+deb11u6)
forky: resolved (fixed in 8:7.1.2.3+dfsg1-1)
sid: resolved (fixed in 8:7.1.2.3+dfsg1-1)
trixie: resolved (fixed in 8:7.1.1.43+dfsg1-1+deb13u2)
OSV
imagemagick vulnerabilities
osv·2025-09-18·CVSS 7.8
CVE-2025-55154 [HIGH] imagemagick vulnerabilities
imagemagick vulnerabilities
It was discovered that ImageMagick did not properly handle memory when
performing magnified size calculations. An attacker could possibly use this
issue to cause ImageMagick to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2025-55154)
Woojin Park, Hojun Lee, Youngin Won, and Siyeon Han discovered that
ImageMagick incorrectly handled creating thumbnail images for certain
dimensions. An attacker could possibly use this issue to cause ImageMagick
to crash, resulting in a denial of service. This issue only affected Ubuntu
24.04 LTS. (CVE-2025-55212)
Lumina Mescuwa discovered that ImageMagick did not properly handle cloning
splay trees in the MagickCore library. An attacker could possibly use this
issue to cause sanitized builds
OSV
CVE-2025-55212: ImageMagick is free and open-source software used for editing and manipulating digital images
osv·2025-08-26·CVSS 7.5
CVE-2025-55212 [HIGH] CVE-2025-55212: ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (":") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.
OSV
ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crash
osv·2025-08-26
CVE-2025-55212 [LOW] ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crash
ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crash
## Summary
Passing a geometry string containing only a colon (":") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service.
## Details
**Root Cause**
1. `montage -geometry ":" ...` reaches `MagickCore/geometry.c:GetGeometry().`
2. `StringToDouble/InterpretLocaleValue` parses `":"` as `0.0;` then:
https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355
`WidthValue` (and/or `HeightValue)` is set with a zero dimension.
3. In MagickCore/resize.c:ThumbnailImage(), the code computes:
https://github.com/I
GHSA
ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crash
ghsa·2025-08-26
CVE-2025-55212 [LOW] CWE-369 ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crash
ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crash
## Summary
Passing a geometry string containing only a colon (":") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service.
## Details
**Root Cause**
1. `montage -geometry ":" ...` reaches `MagickCore/geometry.c:GetGeometry().`
2. `StringToDouble/InterpretLocaleValue` parses `":"` as `0.0;` then:
https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355
`WidthValue` (and/or `HeightValue)` is set with a zero dimension.
3. In MagickCore/resize.c:ThumbnailImage(), the code computes:
https://github.com/I
No detection rules found.
No public exploits indexed.
https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629https://github.com/ImageMagick/ImageMagick/commit/5f0bcf986b8b5e90567750d31a37af502b73f2afhttps://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fh55-q5pj-pxgwhttps://github.com/dlemstra/Magick.NET/releases/tag/14.8.1https://lists.debian.org/debian-lts-announce/2025/09/msg00012.htmlhttps://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fh55-q5pj-pxgw
2025-08-26
Published