CVE-2025-55298
published 2025-08-26CVE-2025-55298: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format…
PriorityP265high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
4.35%
90.6th percentile
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | imagemagick | < imagemagick 8:6.9.11.60+dfsg-1.6+deb12u4 (bookworm) | imagemagick 8:6.9.11.60+dfsg-1.6+deb12u4 (bookworm) |
| imagemagick | imagemagick | < 7.1.2-2 | 7.1.2-2 |
| imagemagick | imagemagick | < 6.9.13-28 | 6.9.13-28 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.3+deb11u6 | 8:6.9.11.60+dfsg-1.3+deb11u6 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.6+deb12u4 | 8:6.9.11.60+dfsg-1.6+deb12u4 |
| imagemagick | imagemagick | >= 0 < 8:7.1.1.43+dfsg1-1+deb13u2 | 8:7.1.1.43+dfsg1-1+deb13u2 |
| imagemagick | imagemagick | >= 0 < 8:7.1.2.3+dfsg1-1 | 8:7.1.2.3+dfsg1-1 |
| imagemagick | imagemagick | >= 0 < 8:6.7.7.10-6ubuntu3.13+esm15 | 8:6.7.7.10-6ubuntu3.13+esm15 |
| imagemagick | imagemagick | >= 0 < 8:6.8.9.9-7ubuntu5.16+esm14 | 8:6.8.9.9-7ubuntu5.16+esm14 |
| imagemagick | imagemagick | >= 0 < 8:6.9.7.4+dfsg-16ubuntu6.15+esm6 | 8:6.9.7.4+dfsg-16ubuntu6.15+esm6 |
| imagemagick | imagemagick | >= 0 < 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm4 | 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm4 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm4 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm4 |
| imagemagick | imagemagick | >= 0 < 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm3 | 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm3 |
| imagemagick | imagemagick | >= 7.0.0-0 < 7.1.2-2 | 7.1.2-2 |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger condition: filenames containing printf-style format specifiers (e.g., %d, %o, %x) passed to ImageMagick will exercise the vulnerable code path in InterpretImageFilename → FormatLocaleString. ↗
- →Vulnerable function to target in code-level detection or fuzzing: InterpretImageFilename — user input is passed unsanitized directly to FormatLocaleString. ↗
- ·Mitigation available via ImageMagick directive: disable format string parsing by defining the filename as a literal. In wrappers use 'filename:literal'; from the command line use '-define filename:literal=true'. ↗
- ·Fixed versions are ImageMagick 6.9.13-28 and 7.1.2-2 (and later). Deployments running earlier versions are vulnerable. ↗
- ·On Red Hat Enterprise Linux, default OS mitigations (SELinux, ASLR, memory protections) reduce exploitability to denial-of-service in practice. ImageMagick is not shipped in RHEL 8, 9, or 10. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
imagemagick vulnerabilities
osv·2025-10-08·CVSS 8.8
CVE-2025-55298 [HIGH] imagemagick vulnerabilities
imagemagick vulnerabilities
Woojin Park, Hojun Lee, Yougin Won and Siyeon Han discovered that
ImageMagick did not properly sanitize image file names. An attacker could
possibly use this issue to cause a denial of service, obtain sensitive
information, or execute arbitrary code. (CVE-2025-55298)
Lumina Mescuwa discovered that ImageMagick did not properly handle memory
when encoding BMP images. An attacker could possibly use this issue to
cause ImageMagick to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2025-57803)
OSV
ImageMagick has a Format String Bug in InterpretImageFilename leads to arbitrary code execution
osv·2025-08-26
CVE-2025-55298 [HIGH] ImageMagick has a Format String Bug in InterpretImageFilename leads to arbitrary code execution
ImageMagick has a Format String Bug in InterpretImageFilename leads to arbitrary code execution
## Summary
A format string bug vulnerability exists in `InterpretImageFilename` function where user input is directly passed to `FormatLocaleString` without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution.
## Details
### root cause
```
MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
Image *image,const char *format,int value,char *filename,
ExceptionInfo *exception)
{
...
while ((cursor=strchr(cursor,'%')) != (const char *) NULL)
{
const char
*q = cursor;
ssize_t
offset = (ssize_t) (cursor-format);
cursor++; /* move past '%' */
if (*cursor == '%')
{
/*
Escaped %%.
*
OSV
CVE-2025-55298: ImageMagick is free and open-source software used for editing and manipulating digital images
osv·2025-08-26·CVSS 8.8
CVE-2025-55298 [HIGH] CVE-2025-55298: ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.
GHSA
ImageMagick has a Format String Bug in InterpretImageFilename leads to arbitrary code execution
ghsa·2025-08-26
CVE-2025-55298 [HIGH] CWE-123 ImageMagick has a Format String Bug in InterpretImageFilename leads to arbitrary code execution
ImageMagick has a Format String Bug in InterpretImageFilename leads to arbitrary code execution
## Summary
A format string bug vulnerability exists in `InterpretImageFilename` function where user input is directly passed to `FormatLocaleString` without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution.
## Details
### root cause
```
MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
Image *image,const char *format,int value,char *filename,
ExceptionInfo *exception)
{
...
while ((cursor=strchr(cursor,'%')) != (const char *) NULL)
{
const char
*q = cursor;
ssize_t
offset = (ssize_t) (cursor-format);
cursor++; /* move past '%' */
if (*cursor == '%')
{
/*
Escaped %%.
*
Ubuntu
ImageMagick vulnerabilities
vendor_ubuntu·2025-10-08·CVSS 7.5
CVE-2025-55298 [HIGH] ImageMagick vulnerabilities
Title: ImageMagick vulnerabilities
Summary: Several security issues were fixed in ImageMagick.
Woojin Park, Hojun Lee, Yougin Won and Siyeon Han discovered that
ImageMagick did not properly sanitize image file names. An attacker could
possibly use this issue to cause a denial of service, obtain sensitive
information, or execute arbitrary code. (CVE-2025-55298)
Lumina Mescuwa discovered that ImageMagick did not properly handle memory
when encoding BMP images. An attacker could possibly use this issue to
cause ImageMagick to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2025-57803)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
ImageMagick: ImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code execution
vendor_redhat·2025-08-26·CVSS 7.5
CVE-2025-55298 [HIGH] CWE-134 ImageMagick: ImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code execution
ImageMagick: ImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code execution
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.
A flaw was found in ImageMagick. Processing a file with a specially crafted name, specifically one with format specifiers such as %d, %o, or %x, can trigger a format string bug due to imprope
Debian
CVE-2025-55298: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...
vendor_debian·2025·CVSS 7.5
CVE-2025-55298 [HIGH] CVE-2025-55298: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.
Scope: local
bookworm: resolved (fixed in 8:6.9.11.60+dfsg-1.6+deb12u4)
bullseye: resolved (fixed in 8:6.9.11.60+dfsg-1.3+deb11u6)
forky: resolved (fixed in 8:7.1.2.3+dfsg1-1)
sid: resolved (fixed in 8:7.1.2.3+dfsg1-1)
trixie: resolved (fixed in 8:7.1.1.43+dfsg1-1+deb13u2)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-55298 ImageMagick: ImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code execution [fedora-42]
bugzilla·2025-08-26·CVSS 8.8
CVE-2025-55298 [HIGH] CVE-2025-55298 ImageMagick: ImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code execution [fedora-42]
CVE-2025-55298 ImageMagick: ImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code execution [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-1
Bugzilla
CVE-2025-55298 ImageMagick: ImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code execution [epel-all]
bugzilla·2025-08-26·CVSS 8.8
CVE-2025-55298 [HIGH] CVE-2025-55298 ImageMagick: ImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code execution [epel-all]
CVE-2025-55298 ImageMagick: ImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code execution [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
FEDORA-EPEL-2026-1daced0e85 (ImageMagick-7.1.2.27-1.el10_3) has been submitted as an update to Fedora EPEL 10.3.
https://bodhi.fedoraproject.org/updates/FEDOR
https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1https://lists.debian.org/debian-lts-announce/2025/09/msg00012.htmlhttps://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645
2025-08-26
Published