CVE-2025-69204
published 2025-12-30CVE-2025-69204: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.52%
41.2th percentile
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | imagemagick | < imagemagick 8:6.9.11.60+dfsg-1.6+deb12u5 (bookworm) | imagemagick 8:6.9.11.60+dfsg-1.6+deb12u5 (bookworm) |
| imagemagick | imagemagick | < 7.1.2-12 | 7.1.2-12 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.3+deb11u8 | 8:6.9.11.60+dfsg-1.3+deb11u8 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.6+deb12u5 | 8:6.9.11.60+dfsg-1.6+deb12u5 |
| imagemagick | imagemagick | >= 0 < 8:7.1.1.43+dfsg1-1+deb13u4 | 8:7.1.1.43+dfsg1-1+deb13u4 |
| imagemagick | imagemagick | >= 0 < 8:7.1.2.12+dfsg1-1 | 8:7.1.2.12+dfsg1-1 |
| imagemagick | imagemagick | >= 0 < 8:6.7.7.10-6ubuntu3.13+esm17 | 8:6.7.7.10-6ubuntu3.13+esm17 |
| imagemagick | imagemagick | >= 0 < 8:6.8.9.9-7ubuntu5.16+esm16 | 8:6.8.9.9-7ubuntu5.16+esm16 |
| imagemagick | imagemagick | >= 0 < 8:6.9.7.4+dfsg-16ubuntu6.15+esm8 | 8:6.9.7.4+dfsg-16ubuntu6.15+esm8 |
| imagemagick | imagemagick | >= 0 < 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm6 | 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm6 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm6 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm6 |
| imagemagick | imagemagick | >= 0 < 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm5 | 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm5 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
vendor_ubuntu2.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
imagemagick vulnerabilities
osv·2026-02-03·CVSS 7.5
CVE-2025-43965 [HIGH] imagemagick vulnerabilities
imagemagick vulnerabilities
It was discovered that ImageMagick incorrectly handled image depth values
when processing MIFF image files. An attacker could use this issue to cause
a denial of service or possibly execute arbitrary code. (CVE-2025-43965)
It was discovered that ImageMagick incorrectly processed SVG images and
MSL files. An attacker could possibly use this issue to cause a denial of
service. (CVE-2025-68618)
It was discovered that ImageMagick incorrectly handled memory when
converting MVG files. An attacker could possibly use this issue to cause a
denial of service. (CVE-2025-69204)
OSV
CVE-2025-69204: ImageMagick is free and open-source software used for editing and manipulating digital images
osv·2025-12-30·CVSS 7.5
CVE-2025-69204 [HIGH] CVE-2025-69204: ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue.
Ubuntu
ImageMagick vulnerabilities
vendor_ubuntu·2026-02-03·CVSS 2.9
CVE-2025-68618 [LOW] ImageMagick vulnerabilities
Title: ImageMagick vulnerabilities
Summary: Several security issues were fixed in ImageMagick.
It was discovered that ImageMagick incorrectly handled image depth values
when processing MIFF image files. An attacker could use this issue to cause
a denial of service or possibly execute arbitrary code. (CVE-2025-43965)
It was discovered that ImageMagick incorrectly processed SVG images and
MSL files. An attacker could possibly use this issue to cause a denial of
service. (CVE-2025-68618)
It was discovered that ImageMagick incorrectly handled memory when
converting MVG files. An attacker could possibly use this issue to cause a
denial of service. (CVE-2025-69204)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
ImageMagick: ImageMagick: Denial of Service via integer overflow in SVG image processing
vendor_redhat·2025-12-30·CVSS 5.3
CVE-2025-69204 [MEDIUM] CWE-190 ImageMagick: ImageMagick: Denial of Service via integer overflow in SVG image processing
ImageMagick: ImageMagick: Denial of Service via integer overflow in SVG image processing
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue.
A flaw was found in ImageMagick, a free and open-source software used for editing and manipulating digital images. A remote attacker can exploit this vulnerability by providing a specially crafted SVG (Scalable Vector Graphics) image. An integer overflow occurs in the WriteSVGImage function when storing number_attributes, which subsequently triggers a buffer overflow. This c
Debian
CVE-2025-69204: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...
vendor_debian·2025·CVSS 5.3
CVE-2025-69204 [MEDIUM] CVE-2025-69204: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue.
Scope: local
bookworm: resolved (fixed in 8:6.9.11.60+dfsg-1.6+deb12u5)
bullseye: resolved (fixed in 8:6.9.11.60+dfsg-1.3+deb11u8)
forky: resolved (fixed in 8:7.1.2.12+dfsg1-1)
sid: resolved (fixed in 8:7.1.2.12+dfsg1-1)
trixie: resolved (fixed in 8:7.1.1.43+dfsg1-1+deb13u4)
No detection rules found.
No public exploits indexed.
Wiz
CVE-2025-69204 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2025-69204 [MEDIUM] CVE-2025-69204 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-69204 :
ImageMagick vulnerability analysis and mitigation
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue.
Source : NVD
## 7.5
Score
Published December 30, 2025
Severity HIGH
CNA Score 5.3
Affected Technologies
ImageMagick
Linux Red Hat
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 28.1
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
ImageMagick-c++
ImageMagick-perl
S
Bugzilla
CVE-2025-69204 ImageMagick: ImageMagick: Denial of Service via integer overflow in SVG image processing [fedora-42]
bugzilla·2026-01-01·CVSS 7.5
CVE-2025-69204 [HIGH] CVE-2025-69204 ImageMagick: ImageMagick: Denial of Service via integer overflow in SVG image processing [fedora-42]
CVE-2025-69204 ImageMagick: ImageMagick: Denial of Service via integer overflow in SVG image processing [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedor
2025-12-30
Published