CVE-2025-55298: ImageMagick RCE Vulnerability

CVE-2025-55298 Overview

CVE-2025-55298 is a format string vulnerability in ImageMagick, the widely deployed open-source image processing library. The flaw resides in the InterpretImageFilename function, which passes user-controlled input directly to FormatLocaleString without sanitization. Attackers who can supply crafted filenames to ImageMagick can overwrite arbitrary memory regions, leading to outcomes ranging from heap corruption to remote code execution.

The issue affects ImageMagick versions prior to 6.9.13-28 and 7.1.2-2. Given ImageMagick's role as a backend component in web applications, content management systems, and image-processing pipelines, exposure is broad across server environments.

Critical Impact

Attackers with the ability to control filename parameters processed by ImageMagick can achieve arbitrary memory writes and potentially remote code execution on the affected host.

Affected Products

• ImageMagick versions prior to 6.9.13-28
• ImageMagick versions prior to 7.1.2-2
• Downstream packages including Magick.NET prior to 14.8.1 and Debian LTS distributions

Discovery Timeline

• 2025-08-26 - CVE-2025-55298 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-55298

Vulnerability Analysis

The vulnerability is a classic format string bug [CWE-123 related to write-what-where conditions]. ImageMagick's InterpretImageFilename function constructs output filenames using format specifiers parsed from user input. When that input reaches FormatLocaleString without escaping, an attacker can embed conversion specifiers such as %s, %n, or %x directly into the format string argument.

The %n specifier is especially dangerous. It instructs the formatting routine to write the number of bytes produced so far to a memory address taken from the argument stack. An attacker who controls the format string can therefore direct writes to chosen addresses, corrupting heap metadata, function pointers, or return addresses.

Exploitation requires the attacker to influence the filename passed to ImageMagick conversion operations. Many web applications generate output filenames from user-supplied parameters such as upload names, conversion presets, or URL query strings, creating a viable attack surface.

Root Cause

The root cause is the absence of input sanitization between filename parsing and format string consumption. InterpretImageFilename treated user-controlled input as a trusted format template instead of a data argument to a fixed format string such as "%s".

Attack Vector

The attack vector is network-based and requires low privileges. An authenticated user, or any user of an application that exposes ImageMagick processing of user-supplied filenames, can trigger the flaw. The vulnerability impacts confidentiality, integrity, and availability because arbitrary memory writes enable both code execution and process crashes.

No verified public proof-of-concept is currently linked in the advisory. Refer to the GitHub Security Advisory GHSA-9ccg-6pjw-x645 and the upstream patch commit for technical details.

Detection Methods for CVE-2025-55298

Indicators of Compromise

• Filenames or conversion arguments passed to ImageMagick containing format specifiers such as %n, %s, %x, or %p
• Unexpected crashes, segmentation faults, or aborts in convert, magick, or mogrify processes
• Child processes spawned by ImageMagick that do not match normal image processing workflows

Detection Strategies

• Inspect application logs for filename parameters containing % characters in positions where format specifiers are not expected
• Monitor ImageMagick binaries for abnormal memory access patterns and crashes recorded in system logs such as /var/log/syslog or dmesg
• Audit installed ImageMagick versions across servers and containers and flag any version below 6.9.13-28 or 7.1.2-2

Monitoring Recommendations

• Enable core dump collection for ImageMagick processes to capture exploitation attempts for forensic analysis
• Track process lineage where ImageMagick is a parent of shells, network utilities, or interpreters such as bash, nc, or python
• Forward web server and application logs that capture upload and conversion parameters to a centralized analytics platform for retroactive search

How to Mitigate CVE-2025-55298

Immediate Actions Required

• Upgrade ImageMagick to version 6.9.13-28 or 7.1.2-2 or later on all systems
• Update downstream wrappers such as Magick.NET to 14.8.1 or later and apply distribution patches including the Debian LTS update
• Audit applications that pass user-controlled filenames to ImageMagick and add server-side validation that rejects % characters in filename fields

Patch Information

The ImageMagick maintainers fixed the issue in commit 439b362b93c074eea6c3f834d84982b43ef057d5. The patch is included in releases 6.9.13-28 and 7.1.2-2. Review the GitHub commit for the exact code changes, which route user input through a fixed format string rather than passing it as the format argument.

Workarounds

• Sanitize all user-supplied filename inputs by stripping or rejecting % characters before invocation
• Run ImageMagick under reduced privileges using sandboxing tools such as seccomp, AppArmor, or container isolation
• Restrict ImageMagick policy via policy.xml to disable unnecessary coders and limit resource consumption

# Verify patched ImageMagick version is installed
magick -version | head -n 1

# Debian/Ubuntu update
sudo apt-get update && sudo apt-get install --only-upgrade imagemagick

# RHEL/CentOS update
sudo dnf upgrade ImageMagick