CVE-2025-55154

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
ImageMagick	ImageMagick	< 6.9.13-27; < 7.1.2-1

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp29-wxp5-wh82Exploit, Vendor Advisory
https://goo.gle/bigsleepIssue Tracking
https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html

Timeline

Published: Aug 13, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-551555.4Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, when a user edits their profile to change their CVE-2025-551567.8pyLoad is the free and open-source Download Manager written in pure Python. Prior to version 0.5.0b3.dev91, the parameter add_links in API /CVE-2025-551578.8Vim is an open source, command line text editor. In versions from 9.1.1231 to before 9.1.1400, When processing nested tuples in Vim script, CVE-2025-551588.8Vim is an open source, command line text editor. In versions from 9.1.1231 to before 9.1.1406, when processing nested tuples during Vim9 scr CVE-2025-551595.1slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were CVE-2025-55164.8A vulnerability, which was classified as problematic, was found in TOTOLINK X2000R 1.0.0-B20230726.1108. This affects an unknown part of the CVE-2025-551605.3ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, ther CVE-2025-551619.8Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/CVE-2025-551628.8Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In versions below 1.32.10 a CVE-2025-551637.5Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable t CVE-2025-551648.8content-security-policy-parser parses content security policy directives. A prototype pollution vulnerability exists in versions 0.5.0 and e CVE-2025-551658.2Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database. Prior to ver