CVE-2025-55160: ImageMagick Splay Tree DoS Vulnerability

CVE-2025-55160 Overview

CVE-2025-55160 affects ImageMagick, the open-source image editing and manipulation library used across web servers, content pipelines, and desktop applications. The vulnerability stems from undefined behavior (function-type-mismatch) in the splay tree cloning callback. Under UndefinedBehaviorSanitizer (UBSan) builds, this triggers a deterministic abort, producing a denial-of-service condition. Non-sanitized production builds do not crash, which limits real-world exploitability. The issue is tracked under [CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior]. ImageMagick versions prior to 6.9.13-27 and 7.1.2-1 are affected. Patched releases are available for both maintenance branches.

Critical Impact
Attackers can trigger a deterministic process abort in UBSan-instrumented builds of ImageMagick, resulting in denial of service for sanitizer-based deployments and fuzzing pipelines.

Affected Products

ImageMagick versions prior to 6.9.13-27 (6.x branch)
ImageMagick versions prior to 7.1.2-1 (7.x branch)
Applications and services embedding vulnerable ImageMagick builds compiled with UBSan

Discovery Timeline

2025-08-13 - CVE-2025-55160 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55160

Vulnerability Analysis

The defect resides in ImageMagick's splay tree implementation, specifically in how a cloning callback function pointer is invoked. The callback is called through a function pointer whose declared signature does not match the actual function's signature. This mismatch is undefined behavior in C, and the UndefinedBehaviorSanitizer's function check detects it and aborts the process. Splay trees are used internally by ImageMagick for caching and resource management, so the code path is reachable through common image parsing operations. The vulnerability affects availability only, with no impact on confidentiality or integrity.

Root Cause

The root cause is a function-type-mismatch in the splay tree cloning callback registration. A callback pointer was cast to a signature that differs from its actual definition, violating the C standard's requirement that function pointers be called through a compatible type. Compilers frequently generate correct code despite the mismatch, which is why non-sanitized builds do not crash. UBSan enforces the standard strictly and terminates execution when the mismatch is observed at runtime.

Attack Vector

The attack vector is network-adjacent when ImageMagick processes untrusted images uploaded to a service. A crafted image that exercises the splay tree cloning path triggers the abort on any UBSan-instrumented deployment. Continuous integration systems, fuzzing harnesses, and hardened builds running with -fsanitize=undefined are the primary targets. Standard production builds compiled without UBSan remain functional but still carry the underlying undefined behavior. The vulnerability requires no authentication and no user interaction.

No public proof-of-concept code has been released. Technical details are documented in the GitHub Security Advisory GHSA-6hgw-6x87-578x.

Detection Methods for CVE-2025-55160

Indicators of Compromise

Unexpected SIGABRT termination of ImageMagick worker processes on UBSan-enabled hosts
UBSan runtime messages referencing function-type-mismatch in splay tree code paths
Repeated crashes of image conversion services following upload of specific attacker-supplied images
Core dumps referencing CloneSplayTree or related splay tree functions

Detection Strategies

Inventory all ImageMagick binaries and libraries; verify versions against 6.9.13-27 and 7.1.2-1
Review build configurations for -fsanitize=undefined and identify sanitizer-instrumented deployments
Enable process crash logging on hosts running ImageMagick to capture abort events
Correlate image upload activity with worker process termination in application logs

Monitoring Recommendations

Track ImageMagick process exit codes and restart counts through host telemetry
Alert on abnormal termination rates for services performing image conversion
Monitor upstream package advisories from Linux distributions for backported patches
Log EPSS trend changes for CVE-2025-55160; current EPSS probability is 0.38%

How to Mitigate CVE-2025-55160

Immediate Actions Required

Upgrade ImageMagick to version 6.9.13-27 or 7.1.2-1 or later on all systems
Rebuild any statically linked applications against the patched ImageMagick source tree
Restart services that load ImageMagick libraries to ensure the patched version is in memory
Validate patch application by checking library versions with identify --version

Patch Information

The ImageMagick maintainers released fixed versions 6.9.13-27 and 7.1.2-1. The patch corrects the splay tree cloning callback signature to match its declared prototype, eliminating the undefined behavior. Full details are available in the GitHub Security Advisory GHSA-6hgw-6x87-578x. Linux distribution maintainers typically publish backported packages; verify availability through your package manager.

Workarounds

Disable UBSan (-fsanitize=undefined) in production builds if immediate patching is not possible
Restrict image upload sources to trusted users until the patched version is deployed
Isolate ImageMagick processing in sandboxed workers with automatic restart on abort
Apply resource limits and rate limiting on image processing endpoints to reduce DoS impact

bash

# Verify installed ImageMagick version
identify --version

# Upgrade on Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade imagemagick

# Upgrade on RHEL/CentOS/Fedora
sudo dnf upgrade ImageMagick

# Confirm patched version (6.9.13-27 or 7.1.2-1 or later)
convert -version | grep Version