CVE-2025-65955
published 2025-12-02CVE-2025-65955: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-9 and 6.9.13-34, there is a vulnerability in…
PriorityP426medium6.1CVSS 3.1
AVLACLPRLUINSUCNILAH
EPSS
0.16%
4.7th percentile
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-9 and 6.9.13-34, there is a vulnerability in ImageMagick’s Magick++ layer that manifests when Options::fontFamily is invoked with an empty string. Clearing a font family calls RelinquishMagickMemory on _drawInfo->font, freeing the font string but leaving _drawInfo->font pointing to freed memory while _drawInfo->family is set to that (now-invalid) pointer. Any later cleanup or reuse of _drawInfo->font re-frees or dereferences dangling memory. DestroyDrawInfo and other setters (Options::font, Image::font) assume _drawInfo->font remains valid, so destruction or subsequent updates trigger crashes or heap corruption. This vulnerability is fixed in 7.1.2-9 and 6.9.13-34.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | imagemagick | < imagemagick 8:6.9.11.60+dfsg-1.6+deb12u5 (bookworm) | imagemagick 8:6.9.11.60+dfsg-1.6+deb12u5 (bookworm) |
| imagemagick | imagemagick | < 6.9.13-34 | 6.9.13-34 |
| imagemagick | imagemagick | — | — |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.3+deb11u8 | 8:6.9.11.60+dfsg-1.3+deb11u8 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.6+deb12u5 | 8:6.9.11.60+dfsg-1.6+deb12u5 |
| imagemagick | imagemagick | >= 0 < 8:7.1.1.43+dfsg1-1+deb13u4 | 8:7.1.1.43+dfsg1-1+deb13u4 |
| imagemagick | imagemagick | >= 0 < 8:7.1.2.12+dfsg1-1 | 8:7.1.2.12+dfsg1-1 |
| imagemagick | imagemagick | >= 7.0.0-0 < 7.1.2-9 | 7.1.2-9 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
osv6.1MEDIUM
vendor_debian4.9MEDIUM
vendor_redhat4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
imagemagick: ImageMagick use-after-free/double-free
vendor_redhat·2025-12-02·CVSS 4.9
CVE-2025-65955 [MEDIUM] CWE-825 imagemagick: ImageMagick use-after-free/double-free
imagemagick: ImageMagick use-after-free/double-free
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-9 and 6.9.13-34, there is a vulnerability in ImageMagick’s Magick++ layer that manifests when Options::fontFamily is invoked with an empty string. Clearing a font family calls RelinquishMagickMemory on _drawInfo->font, freeing the font string but leaving _drawInfo->font pointing to freed memory while _drawInfo->family is set to that (now-invalid) pointer. Any later cleanup or reuse of _drawInfo->font re-frees or dereferences dangling memory. DestroyDrawInfo and other setters (Options::font, Image::font) assume _drawInfo->font remains valid, so destruction or subsequent updates trigger crashes or heap corruption. This vulnerabilit
Debian
CVE-2025-65955: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...
vendor_debian·2025·CVSS 4.9
CVE-2025-65955 [MEDIUM] CVE-2025-65955: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-9 and 6.9.13-34, there is a vulnerability in ImageMagick’s Magick++ layer that manifests when Options::fontFamily is invoked with an empty string. Clearing a font family calls RelinquishMagickMemory on _drawInfo->font, freeing the font string but leaving _drawInfo->font pointing to freed memory while _drawInfo->family is set to that (now-invalid) pointer. Any later cleanup or reuse of _drawInfo->font re-frees or dereferences dangling memory. DestroyDrawInfo and other setters (Options::font, Image::font) assume _drawInfo->font remains valid, so destruction or subsequent updates trigger crashes or heap corruption. This vulnerability is fixed in 7.1.2-9 and 6.9.13-34.
Scope: local
boo
OSV
Withdrawn Advisory: ImageMagick has a use-after-free/double-free risk in Options::fontFamily when clearing family
osv·2025-12-03
CVE-2025-65955 [MEDIUM] Withdrawn Advisory: ImageMagick has a use-after-free/double-free risk in Options::fontFamily when clearing family
Withdrawn Advisory: ImageMagick has a use-after-free/double-free risk in Options::fontFamily when clearing family
## Withdrawn Advisory
This advisory has been withdrawn because it does not affect the ImageMagick project's NuGet packages.
### Original Description
We believe that we have discovered a potential security vulnerability in ImageMagick’s Magick++ layer that manifests when `Options::fontFamily` is invoked with an empty string.
**Vulnerability Details**
- Clearing a font family calls `RelinquishMagickMemory` on `_drawInfo->font`, freeing the font string but leaving `_drawInfo->font` pointing to freed memory while `_drawInfo->family` is set to that (now-invalid) pointer. Any later cleanup or reuse of `_drawInfo->font` re-frees or dereferences dangling memory.
- `DestroyDrawInfo`
GHSA
Withdrawn Advisory: ImageMagick has a use-after-free/double-free risk in Options::fontFamily when clearing family
ghsa·2025-12-03
CVE-2025-65955 [MEDIUM] CWE-415 Withdrawn Advisory: ImageMagick has a use-after-free/double-free risk in Options::fontFamily when clearing family
Withdrawn Advisory: ImageMagick has a use-after-free/double-free risk in Options::fontFamily when clearing family
## Withdrawn Advisory
This advisory has been withdrawn because it does not affect the ImageMagick project's NuGet packages.
### Original Description
We believe that we have discovered a potential security vulnerability in ImageMagick’s Magick++ layer that manifests when `Options::fontFamily` is invoked with an empty string.
**Vulnerability Details**
- Clearing a font family calls `RelinquishMagickMemory` on `_drawInfo->font`, freeing the font string but leaving `_drawInfo->font` pointing to freed memory while `_drawInfo->family` is set to that (now-invalid) pointer. Any later cleanup or reuse of `_drawInfo->font` re-frees or dereferences dangling memory.
- `DestroyDrawInfo`
OSV
CVE-2025-65955: ImageMagick is free and open-source software used for editing and manipulating digital images
osv·2025-12-02·CVSS 6.1
CVE-2025-65955 [MEDIUM] CVE-2025-65955: ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-9 and 6.9.13-34, there is a vulnerability in ImageMagick’s Magick++ layer that manifests when Options::fontFamily is invoked with an empty string. Clearing a font family calls RelinquishMagickMemory on _drawInfo->font, freeing the font string but leaving _drawInfo->font pointing to freed memory while _drawInfo->family is set to that (now-invalid) pointer. Any later cleanup or reuse of _drawInfo->font re-frees or dereferences dangling memory. DestroyDrawInfo and other setters (Options::font, Image::font) assume _drawInfo->font remains valid, so destruction or subsequent updates trigger crashes or heap corruption. This vulnerability is fixed in 7.1.2-9 and 6.9.13-34.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-65955 ImageMagick: ImageMagick use-after-free/double-free [epel-9]
bugzilla·2025-12-03·CVSS 6.1
CVE-2025-65955 [MEDIUM] CVE-2025-65955 ImageMagick: ImageMagick use-after-free/double-free [epel-9]
CVE-2025-65955 ImageMagick: ImageMagick use-after-free/double-free [epel-9]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
FEDORA-EPEL-2026-602703bf01 (ImageMagick-6.9.13.58-1.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-602703bf01
Bugzilla
CVE-2025-65955 ImageMagick: ImageMagick use-after-free/double-free [fedora-42]
bugzilla·2025-12-03·CVSS 6.1
CVE-2025-65955 [MEDIUM] CVE-2025-65955 ImageMagick: ImageMagick use-after-free/double-free [fedora-42]
CVE-2025-65955 ImageMagick: ImageMagick use-after-free/double-free [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports f
Bugzilla
CVE-2025-65955 ImageMagick: ImageMagick use-after-free/double-free [epel-8]
bugzilla·2025-12-03·CVSS 6.1
CVE-2025-65955 [MEDIUM] CVE-2025-65955 ImageMagick: ImageMagick use-after-free/double-free [epel-8]
CVE-2025-65955 ImageMagick: ImageMagick use-after-free/double-free [epel-8]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
ImageMagick 6.9.13.57 is available for EPEL 8. This version is newer than the upstream releases containing the fixes for the reported vulnerabilities. Closing as fixed in the current release.
Bugzilla
CVE-2025-65955 ImageMagick: ImageMagick use-after-free/double-free [fedora-43]
bugzilla·2025-12-03·CVSS 6.1
CVE-2025-65955 [MEDIUM] CVE-2025-65955 ImageMagick: ImageMagick use-after-free/double-free [fedora-43]
CVE-2025-65955 ImageMagick: ImageMagick use-after-free/double-free [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
ImageMagick 7.1.2.32 contains the upstream fixes for the reported vulnerabilities and is available for the affected supported release. Closing as fixed in the current release.
Bugzilla
CVE-2025-65955 ImageMagick: ImageMagick use-after-free/double-free [epel-10]
bugzilla·2025-12-03·CVSS 6.1
CVE-2025-65955 [MEDIUM] CVE-2025-65955 ImageMagick: ImageMagick use-after-free/double-free [epel-10]
CVE-2025-65955 ImageMagick: ImageMagick use-after-free/double-free [epel-10]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
FEDORA-EPEL-2026-b27f635f06 (ImageMagick-7.1.2.32-1.el10_3) has been submitted as an update to Fedora EPEL 10.3.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-b27f635f06
---
FEDORA-EPEL-2026-5a3ad0
2025-12-02
Published