CVE-2025-62171
published 2025-10-17CVE-2025-62171: ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.76%
51.1th percentile
ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. The vulnerability is fixed in versions 7.1.2-7 and 6.9.13-32.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | imagemagick | < imagemagick 8:6.9.11.60+dfsg-1.6+deb12u5 (bookworm) | imagemagick 8:6.9.11.60+dfsg-1.6+deb12u5 (bookworm) |
| imagemagick | imagemagick | < 6.9.13-32 | 6.9.13-32 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.3+deb11u7 | 8:6.9.11.60+dfsg-1.3+deb11u7 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.6+deb12u5 | 8:6.9.11.60+dfsg-1.6+deb12u5 |
| imagemagick | imagemagick | >= 0 < 8:7.1.1.43+dfsg1-1+deb13u3 | 8:7.1.1.43+dfsg1-1+deb13u3 |
| imagemagick | imagemagick | >= 0 < 8:7.1.2.7+dfsg1-1 | 8:7.1.2.7+dfsg1-1 |
| imagemagick | imagemagick | >= 7.0.0-0 < 7.1.2-7 | 7.1.2-7 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ghsa8.8HIGH
osv8.8HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
ImageMagick vulnerability
vendor_ubuntu·2025-11-20·CVSS 7.5
CVE-2025-62171 [HIGH] ImageMagick vulnerability
Title: ImageMagick vulnerability
Summary: ImageMagick could be made to crash or run programs as your login if it
opened a specially crafted file.
It was discovered that ImageMagick did not properly handle memory when
encoding BMP images. An attacker could possibly use this issue to cause
ImageMagick to crash, resulting in a denial of service, or possibly
execute arbitrary code. This issue exists due to an incomplete fix for
CVE-2025-57803.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
ImageMagick: ImageMagick vulnerable to denial of service via integer overflow in BMP decoder on 32-bit systems
vendor_redhat·2025-10-17·CVSS 7.5
CVE-2025-62171 [HIGH] CWE-190 ImageMagick: ImageMagick vulnerable to denial of service via integer overflow in BMP decoder on 32-bit systems
ImageMagick: ImageMagick vulnerable to denial of service via integer overflow in BMP decoder on 32-bit systems
ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912
Debian
CVE-2025-62171: imagemagick - ImageMagick is an open source software suite for displaying, converting, and edi...
vendor_debian·2025·CVSS 7.5
CVE-2025-62171 [HIGH] CVE-2025-62171: imagemagick - ImageMagick is an open source software suite for displaying, converting, and edi...
ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vu
GHSA
ImageMagick has Integer Overflow in BMP Decoder (ReadBMP)
ghsa·2025-10-28·CVSS 8.8
CVE-2025-62171 [HIGH] CWE-190 ImageMagick has Integer Overflow in BMP Decoder (ReadBMP)
ImageMagick has Integer Overflow in BMP Decoder (ReadBMP)
## Summary
CVE-2025-57803 claims to be patched in ImageMagick 7.1.2-2, but **the fix is incomplete and ineffective**. The latest version **7.1.2-5 remains vulnerable** to the same integer overflow attack.
The patch added `BMPOverflowCheck()` but placed it **after** the overflow occurs, making it useless. A malicious 58-byte BMP file can trigger AddressSanitizer crashes and DoS.
**Affected Versions:**
- ImageMagick columns * bmp_info.bits_per_pixel; // OVERFLOW!
// Line 1121: Uses already-overflowed value
bytes_per_line = 4*((extent+31)/32);
// Line 1122: Checks the RESULT, not the multiplication
if (BMPOverflowCheck(bytes_per_line, image->rows) != MagickFalse)
ThrowReaderException(CorruptImageError, "InsufficientImageDataInFil
OSV
ImageMagick has Integer Overflow in BMP Decoder (ReadBMP)
osv·2025-10-28·CVSS 8.8
CVE-2025-62171 [HIGH] ImageMagick has Integer Overflow in BMP Decoder (ReadBMP)
ImageMagick has Integer Overflow in BMP Decoder (ReadBMP)
## Summary
CVE-2025-57803 claims to be patched in ImageMagick 7.1.2-2, but **the fix is incomplete and ineffective**. The latest version **7.1.2-5 remains vulnerable** to the same integer overflow attack.
The patch added `BMPOverflowCheck()` but placed it **after** the overflow occurs, making it useless. A malicious 58-byte BMP file can trigger AddressSanitizer crashes and DoS.
**Affected Versions:**
- ImageMagick columns * bmp_info.bits_per_pixel; // OVERFLOW!
// Line 1121: Uses already-overflowed value
bytes_per_line = 4*((extent+31)/32);
// Line 1122: Checks the RESULT, not the multiplication
if (BMPOverflowCheck(bytes_per_line, image->rows) != MagickFalse)
ThrowReaderException(CorruptImageError, "InsufficientImageDataInFil
OSV
CVE-2025-62171: ImageMagick is an open source software suite for displaying, converting, and editing raster image files
osv·2025-10-17·CVSS 8.8
CVE-2025-62171 [HIGH] CVE-2025-62171: ImageMagick is an open source software suite for displaying, converting, and editing raster image files
ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vu
No detection rules found.
No public exploits indexed.
2025-10-17
Published