CVE-2025-55298
Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.39%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 4.39% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-123, CWE-134
- Affected
- imagemagick/imagemagick
- Source
- security-advisories@github.com
References
- https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5Patch
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645Exploit, Vendor Advisory
- https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1Release Notes
- https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645Exploit, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.