Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
CVE-2025-62171: ImageMagick on 32-bit systems can be tricked into crashing
CVE-2025-62171 · published 1 year ago
Summary
Older 32-bit versions of ImageMagick can be crashed by a specially crafted image file. If you're using a 32-bit version of ImageMagick and haven't updated, update to version 7.1.2-7 or 6.9.13-32 to fix the problem.
What to do
- Update dirk lemstra magick.net-q8-anycpu to version 14.9.0.
- Update dirk lemstra magick.net-q16-hdri-anycpu to version 14.9.0.
- Update dirk lemstra magick.net-q16-anycpu to version 14.9.0.
- Update dirk lemstra magick.net-q16-x86 to version 14.9.0.
- Update dirk lemstra magick.net-q16-hdri-x86 to version 14.9.0.
- Update dirk lemstra magick.net-q8-x86 to version 14.9.0.
- Update debian rootio-imagemagick to version 8:6.9.11.60+dfsg-1.6+deb12u4.root.io.17.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| nuget | dirk lemstra | magick.net-q8-anycpu |
< 14.9.0 Fix: upgrade to 14.9.0
|
| nuget | dirk lemstra | magick.net-q16-hdri-anycpu |
< 14.9.0 Fix: upgrade to 14.9.0
|
| nuget | dirk lemstra | magick.net-q16-anycpu |
< 14.9.0 Fix: upgrade to 14.9.0
|
| nuget | dirk lemstra | magick.net-q16-x86 |
< 14.9.0 Fix: upgrade to 14.9.0
|
| nuget | dirk lemstra | magick.net-q16-hdri-x86 |
< 14.9.0 Fix: upgrade to 14.9.0
|
| nuget | dirk lemstra | magick.net-q8-x86 |
< 14.9.0 Fix: upgrade to 14.9.0
|
| – | imagemagick | imagemagick |
< 6.9.13-32 >= 7.0.0-0, < 7.1.2-7 cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* |
| Root:Debian:12 | debian | rootio-imagemagick |
< 8:6.9.11.60+dfsg-1.6+deb12u4.root.io.17 Fix: upgrade to 8:6.9.11.60+dfsg-1.6+deb12u4.root.io.17
|
Original advisory text
ImageMagick vulnerable to denial of service via integer overflow in BMP decoder on 32-bit systems
ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. The vulnerability is fixed in versions 7.1.2-7 and 6.9.13-32.
References
- https://github.com/dlemstra/Magick.NET/releases/tag/14.9.0
- https://nvd.nist.gov/vuln/detail/CVE-2025-62171 Vendor Advisory
- https://github.com/advisories/GHSA-9pp9-cfwx-54rm
- https://lists.debian.org/debian-lts-announce/2025/10/msg00019.html URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62171... Vendor Advisory
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9pp9-cfwx-54... Vendor Advisory
- https://github.com/ImageMagick/ImageMagick/commit/cea1693e2ded51b4cc91c70c54096c... Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
5.9
Medium
Type
CWE-190Integer Overflow
Timeline
Published17 Oct 2025
Updated31 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta