CVE-2025-55005: ImageMagick Buffer Overflow Vulnerability

CVE-2025-55005 Overview

CVE-2025-55005 is a heap-based buffer overflow [CWE-122] in ImageMagick, the open-source image manipulation library. The flaw resides in the logmap construction routine used when transforming images between Log and sRGB colorspaces. When the reference-black or reference-white value exceeds 1024, the code writes beyond the allocated logmap buffer, corrupting adjacent heap memory. The issue affects all versions of ImageMagick prior to 7.1.2-1 and requires local access with user interaction to trigger. Successful exploitation impacts availability of the process performing the colorspace transform.

Critical Impact
Processing a crafted image or command-line argument with out-of-range Log colorspace reference values corrupts heap memory and crashes ImageMagick or dependent applications.

Affected Products

ImageMagick versions prior to 7.1.2-1
Applications and services that embed the affected ImageMagick library
Image processing pipelines that accept user-supplied images or colorspace parameters

Discovery Timeline

2025-08-13 - CVE-2025-55005 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55005

Vulnerability Analysis

The vulnerability is a heap buffer overflow in the logmap construction path used when ImageMagick converts pixel data from Log colorspace to sRGB. ImageMagick builds a lookup table (the logmap) sized against an internal constant, but the population loop bounds are driven by the reference-black and reference-white parameters. When either value exceeds 1024, the loop indexes past the end of the allocated buffer and writes attacker-influenced entries into adjacent heap memory.

Because the corruption occurs during a routine image-processing operation, it can be triggered whenever the caller controls colorspace conversion parameters. The CWE-122 classification reflects a linear heap write beyond the intended allocation. The attack requires local access and user interaction, which limits mass exploitation but remains relevant for any workflow that feeds untrusted image metadata or command-line arguments into ImageMagick.

Root Cause

The logmap construction routine fails to validate that reference-black and reference-white are within the size of the allocated logmap buffer before iterating. The absence of a bounds check between the user-supplied colorspace reference values and the fixed 1024-entry buffer allows out-of-bounds writes. See the ImageMagick GitHub Security Advisory GHSA-v393-38qx-v8fp for the specific code path.

Attack Vector

An attacker with local access supplies an image or invokes an ImageMagick operation (for example, through convert or the MagickCore API) that performs a Log-to-sRGB colorspace transform with reference-black or reference-white greater than 1024. The malformed conversion parameters can be embedded in image metadata, delivered via command-line arguments, or set programmatically by a calling application. The resulting heap corruption produces a denial of service and, depending on heap layout, may create conditions for further memory-safety exploitation.

The vulnerability was reported through the Google BigSleep Project, Google's AI-assisted vulnerability research initiative.

Detection Methods for CVE-2025-55005

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linked against ImageMagick during image conversion
Core dumps referencing LogMap, TransformsRGBImage, or logmap-related symbols in ImageMagick
Image files or command-line invocations that specify Log colorspace with reference-black or reference-white values greater than 1024

Detection Strategies

Inventory installed ImageMagick versions across servers, containers, and developer workstations to identify builds prior to 7.1.2-1
Scan container images and software bills of materials for the imagemagick component and pin acceptable minimum versions
Inspect application logs from image-processing services for abnormal termination signals during Log colorspace operations

Monitoring Recommendations

Alert on repeated crashes of image-processing workers, especially those handling user-uploaded content
Log and review ImageMagick command-line arguments and policy.xml settings on hosts that expose conversion functionality
Track outbound network activity from image-processing services after a crash to detect follow-on exploitation attempts

How to Mitigate CVE-2025-55005

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-1 or later on all systems, including container base images and CI/CD runners
Rebuild and redeploy applications that statically link or bundle ImageMagick with the patched release
Restrict which colorspaces and coders are permitted through the ImageMagick policy.xml file until patches are deployed

Patch Information

The issue is fixed in ImageMagick 7.1.2-1. Details are published in the ImageMagick GitHub Security Advisory GHSA-v393-38qx-v8fp. Distributions that ship ImageMagick should backport the fix or update to the patched upstream version.

Workarounds

Disable the Log colorspace in policy.xml by adding a <policy domain="coder" rights="none" pattern="LOG" /> entry where feasible
Validate and sanitize any user-controlled reference-black and reference-white parameters, rejecting values greater than 1024
Run ImageMagick under a sandbox or dedicated low-privilege service account to contain the impact of heap corruption

bash

# Configuration example: restrict ImageMagick colorspace handling in policy.xml
# File: /etc/ImageMagick-7/policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="LOG" />
  <policy domain="resource" name="memory" value="256MiB"/>
  <policy domain="resource" name="map" value="512MiB"/>
</policymap>

# Verify installed ImageMagick version
magick -version | head -n 1