Riskcovery

CVE-2025-55298

ImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code execution

State
Published
Severity
7.5 High
Published
Aug 26, 2025
Updated
Nov 3, 2025
Reserved
Aug 12, 2025

Read the record on cve.org

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HGitHub_M

Weaknesses

  • CWE-123 Write-what-where Condition
  • CWE-134 Use of Externally-Controlled Format String

Affected Products

ProductVersions
ImageMagickImageMagick
  • < 7.1.2-2Affected
  • < 6.9.13-28Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.