CVE-2025-55298

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-123 CWE-134

Affected software

Vendor	Product	Versions
ImageMagick	ImageMagick	< 7.1.2-2; < 6.9.13-28

References

https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5Patch
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645Exploit, Vendor Advisory
https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1Release Notes
https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645Exploit, Vendor Advisory

Timeline

Published: Aug 26, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-552999.4VaulTLS is a modern solution for managing mTLS (mutual TLS) certificates. Prior to 0.9.1, user accounts created through the User web UI have CVE-2025-55305.4The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shortcode_btn' sho CVE-2025-553008.6Komari is a lightweight, self-hosted server monitoring tool designed to provide a simple and efficient solution for monitoring server perfor CVE-2025-553016.7The Scratch Channel is a news website. In version 1, it is possible to go to application in devtools and click local storage to edit the acc CVE-2025-553036.1Astro is a web framework for content-driven websites. In versions of astro before 5.13.2 and 4.16.18, the image optimization endpoint in pro CVE-2025-553045.5Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-serv CVE-2025-553056.1Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions below 35.7.5, 36.0.0-alp CVE-2025-553069.8GenX_FX is an advance IA trading platform that will focus on forex trading. A vulnerability was identified in the GenX FX backend where API CVE-2025-553073.3An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. Opening a malicious PDF containing a crafted CVE-2025-553086.7An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. A crafted PDF containing JavaScript that cal CVE-2025-553096.7An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can contain JavaScri CVE-2025-55316.4The Employee Directory – Staff Listing & Team Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripti