CVE-2025-62594: ImageMagick DoS Vulnerability

CVE-2025-62594 Overview

CVE-2025-62594 affects ImageMagick, a widely deployed software suite used to create, edit, compose, and convert bitmap images. Versions prior to 7.1.2-8 contain a denial-of-service flaw in the CLAHEImage function. When a caller supplies a tile width or height of zero, an unsigned integer underflow occurs during pointer arithmetic and produces out-of-bounds memory access. A parallel division-by-zero condition on the same input causes an immediate process crash. The maintainers patched the issue in ImageMagick 7.1.2-8.

Critical Impact
A local attacker who supplies a crafted image or CLAHE parameters can crash ImageMagick processes and trigger out-of-bounds memory access, resulting in denial of service.

Affected Products

ImageMagick versions prior to 7.1.2-8
Applications and services embedding vulnerable ImageMagick libraries
Image-processing pipelines that expose Contrast Limited Adaptive Histogram Equalization (CLAHE) operations to user input

Discovery Timeline

2025-10-27 - CVE-2025-62594 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62594

Vulnerability Analysis

The defect resides in the CLAHEImage function, which implements Contrast Limited Adaptive Histogram Equalization. The routine divides image dimensions by user-controlled tile width and height values to compute per-tile parameters. When either dimension is zero, the division operation triggers a floating-point or integer division-by-zero fault. The same zero values also participate in unsigned pointer arithmetic. Subtracting from an unsigned index computed against a zero tile size wraps around to a very large value. The resulting pointer references memory far outside the intended pixel buffer. The vulnerability is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Root Cause

The code did not validate that tile width and height were non-zero before using them as divisors and in offset calculations. The mixture of signed offsets cast to unsigned pointer differences allowed the underflow to bypass ordinary range checks.

Attack Vector

Exploitation requires local access and user interaction, such as processing a malicious image or CLAHE configuration through a command-line invocation or library binding. The attacker cannot read or modify data; the impact is limited to high availability loss through crashes and memory faults.

// Patch excerpt from MagickCore/composite.c
           }
         pixels=p;
         if (x_offset < 0)
-          p-=(ptrdiff_t)CastDoubleToSsizeT((double) x_offset*
+          p-=(ptrdiff_t) CastDoubleToSsizeT((double) x_offset*
             GetPixelChannels(source_image));
       }
     q=GetCacheViewAuthenticPixels(image_view,0,y,image->columns,1,exception);

Source: ImageMagick commit 7b47fe3

The patch tightens casting in pointer arithmetic and adds pixel-private.h to MagickCore/enhance.c to support additional bounds handling in the CLAHE code path.

Detection Methods for CVE-2025-62594

Indicators of Compromise

Unexpected SIGFPE or SIGSEGV signals from magick, convert, or applications linking libMagickCore
Core dumps referencing CLAHEImage in the stack trace
Repeated crashes when processing images with CLAHE operations enabled

Detection Strategies

Inventory installed ImageMagick versions and flag any release earlier than 7.1.2-8
Scan container images, build pipelines, and application dependencies for vulnerable ImageMagick binaries and shared libraries
Review command-line arguments and API calls that pass user-supplied tile geometry to CLAHE operations

Monitoring Recommendations

Alert on abnormal termination of image-processing worker processes and job queues
Correlate crash telemetry with recent image uploads or CLAHE processing requests
Track file-format anomalies and malformed geometry parameters in ingestion logs

How to Mitigate CVE-2025-62594

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-8 or later on all hosts, containers, and build images
Rebuild and redeploy applications that statically link ImageMagick libraries
Restrict who can invoke CLAHE operations with attacker-controllable tile geometry

Patch Information

The fix is included in ImageMagick 7.1.2-8. Review the GitHub Security Advisory GHSA-wpp4-vqfq-v4hp and the corresponding ImageMagick commit 7b47fe3 for the code-level changes.

Workarounds

Validate tile width and height parameters and reject any value of zero before passing to CLAHEImage
Disable CLAHE operations in policy files where the feature is not required
Run ImageMagick under process isolation and resource limits so crashes do not propagate to dependent services

bash

# Verify installed ImageMagick version
magick -version | head -n 1

# Debian/Ubuntu upgrade example
sudo apt-get update && sudo apt-get install --only-upgrade imagemagick

# Restrict CLAHE via policy.xml (example)
# <policy domain="filter" rights="none" pattern="CLAHE" />