CVE-2025-55005

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, when preparing to transform from Log to sRGB colorspaces, the logmap construction fails to handle cases where the reference-black or reference-white value is larger than 1024. This leads to corrupting memory beyond the end of the allocated logmap buffer. This issue has been patched in version 7.1.2-1.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-122

Affected software

No affected versions have been published.

Timeline

Published
Aug 13, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-550068.8Frappe Learning is a learning system that helps users structure their content. In versions 2.33.0 and below, the image upload functionality CVE-2025-550075.3Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, Knowage is vulnerable to server-side request fCVE-2025-550087.1The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router.CVE-2025-550097.1The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In veCVE-2025-55015.3A vulnerability classified as problematic was found in Open5GS up to 2.7.3. Affected by this vulnerability is the function ngap_handle_path_CVE-2025-550107.2Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, an unsafe deserialization vulnerabiCVE-2025-550115.3Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, the createTaskFile method in the APCVE-2025-550128.5Zed is a multiplayer code editor. Prior to version 0.197.3, in the Zed Agent Panel allowed for an AI agent to achieve Remote Code Execution CVE-2025-550134.2The Assemblyline 4 Service Client interfaces with the API to fetch tasks and publish the result for a service in Assemblyline 4. In versionsCVE-2025-550144.7The YouDao plugin for StarDict, as used in stardict 3.0.7+git20220909+dfsg-6 in Debian trixie and elsewhere, sends an X11 selection to the dCVE-2025-550179.1Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTCVE-2025-550185.8An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.