CVE-2025-53014

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
3.7 LOW
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
GitHub_MCNA
3.7 LOW
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 19%
VendorProductVersion
imagemagickimagemagick
𝑥
< 6.9.13-26
imagemagickimagemagick
7.0.0-0 ≤
𝑥
< 7.1.2-0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
imagemagick
plucky
needed
noble
Fixed 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm1
released
jammy
Fixed 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm2
released
focal
Fixed 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2
released
bionic
Fixed 8:6.9.7.4+dfsg-16ubuntu6.15+esm4
released
xenial
Fixed 8:6.8.9.9-7ubuntu5.16+esm12
released
trusty
Fixed 8:6.7.7.10-6ubuntu3.13+esm13
released