CVE-2025-62171
MediumCVSS 5.9Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
ImageMagick versions prior to 7.1.2-7 and 6.9.13-32 contain an integer overflow in the BMP decoder on 32-bit systems. When calculating the extent value (columns × bits per pixel), the multiplication can overflow and wrap to zero, and the overflow check added for CVE-2025-57803 is placed after the overflow occurs. Only 32-bit builds with manually increased resource limits are affected; 64-bit systems and default limits are not vulnerable. Fixed in 7.1.2-7 and 6.9.13-32.
Risk Assessment
On vulnerable 32-bit systems, a crafted BMP file can cause incorrect calculations and potentially destabilize image processing.
Recommendation
Update ImageMagick to version 7.1.2-7 or 6.9.13-32 (or later); if possible, restore default resource limits.
Other vulnerabilities in ImageMagick
See all- CVE-2017-17880High
In ImageMagick 7.0.7-16 Q16 x86_64, there is a stack-based buffer over-read in WriteWEBPImage in coders/webp.c, related to a WEBP_DECODER_ABI_VERSION check.
- CVE-2017-17879High
In ImageMagick 7.0.7-16 Q16 x86_64, there is a heap-based buffer over-read in ReadOneMNGImage in coders/png.c, related to length calculation and caused by an off-by-one error.
- CVE-2017-16546High
The ReadWPGImage function in ImageMagick 7.0.7-9 does not properly validate the colormap index in a WPG palette, which may lead to denial of service or other unspecified impacts via a malformed WPG file.
- CVE-2017-15281High
The ReadPSDImage function in coders/psd.c in ImageMagick 7.0.7-6 has a vulnerability that allows remote attackers to cause application crashes or potentially other unspecified impacts via a crafted file.
- CVE-2017-15033High
ImageMagick version 7.0.7-2 contains a memory leak in ReadYUVImage in coders/yuv.c.
- CVE-2017-14739High
The AcquireResampleFilterThreadSet function in ImageMagick 7.0.7-4 mishandles failed memory allocation, which can lead to denial of service via NULL Pointer Dereference in DistortImage.
- CVE-2017-14682High
GetNextToken in MagickCore/token.c in ImageMagick 7.0.6 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted SVG document.
- CVE-2017-14137High
The ReadWEBPImage function in coders/webp.c in ImageMagick 7.0.6-5 has an issue with excessive memory allocation that depends only on a length field in a header.
- CVE-2017-13146High
In ImageMagick before version 6.9.8-5 and 7.x before version 7.0.5-6, there is a memory leak in the ReadMATImage function in coders/mat.c.
- CVE-2017-13143High
In ImageMagick before 6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage function in coders/mat.c uses uninitialized data, which might allow remote attackers to obtain sensitive information from process memory.
Original NVD description (English source)
ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. The vulnerability is fixed in versions 7.1.2-7 and 6.9.13-32.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS