GHSA-fff3-4rp7-px97LowCVSS 3.3

ImageMagick has a heap-buffer-overflow

Published
August 25, 2025
Last Modified
December 31, 2025

🔗 CVE IDs covered (1)

CVE-2025-68469 →

📋 Description

Summary

While Processing a crafted TIFF file, imagemagick crashes.

Details

Following is the imagemagick version:

imagemagick_git/build_26jun23/bin/magick --version
Version: ImageMagick 7.1.1-13 (Beta) Q16-HDRI x86_64 56f478940:20230625 https://imagemagick.org
Copyright: (C) 1999 ImageMagick Studio LLC
License: https://imagemagick.org/script/license.php
Features: Cipher DPC HDRI 
Delegates (built-in): fontconfig freetype jbig jng jpeg lcms lzma pangocairo png tiff webp x xml zlib
Compiler: gcc (4.2)

PoC

issue can be replicated with following command with provided POC file(sent over email):

magick poc.tiff /dev/null

Impact

This can lead to application crash.

Credits

Please give credits to Hardik shah of Vehere (Dawn Treaders team)

🎯 Affected products18

  • nuget/Magick.NET-Q16-AnyCPU:< 13.2.0
  • nuget/Magick.NET-Q16-HDRI-AnyCPU:< 13.2.0
  • nuget/Magick.NET-Q16-HDRI-OpenMP-arm64:< 13.2.0
  • nuget/Magick.NET-Q16-HDRI-OpenMP-x64:< 13.2.0
  • nuget/Magick.NET-Q16-HDRI-arm64:< 13.2.0
  • nuget/Magick.NET-Q16-HDRI-x64:< 13.2.0
  • nuget/Magick.NET-Q16-HDRI-x86:< 13.2.0
  • nuget/Magick.NET-Q16-OpenMP-arm64:< 13.2.0
  • nuget/Magick.NET-Q16-OpenMP-x64:< 13.2.0
  • nuget/Magick.NET-Q16-arm64:< 13.2.0
  • nuget/Magick.NET-Q16-x64:< 13.2.0
  • nuget/Magick.NET-Q16-x86:< 13.2.0
  • nuget/Magick.NET-Q8-AnyCPU:< 13.2.0
  • nuget/Magick.NET-Q8-OpenMP-arm64:< 13.2.0
  • nuget/Magick.NET-Q8-OpenMP-x64:< 13.2.0
  • nuget/Magick.NET-Q8-arm64:< 13.2.0
  • nuget/Magick.NET-Q8-x64:< 13.2.0
  • nuget/Magick.NET-Q8-x86:< 13.2.0

🔗 References (3)