CVE catalog

CVE-2025-62171

ImageMagick vulnerability

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.81% · Oct 25, 2026

ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. The vulnerability is fixed in versions 7.1.2-7 and 6.9.13-32.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianimagemagicksid8:7.1.2.34+dfsg1-1fixed
Debianimagemagickforky8:7.1.2.31+dfsg1-1fixed
Debianimagemagicktrixie8:7.1.1.43+dfsg1-1+deb13u12fixed
Debianimagemagicktrixie-security8:7.1.1.43+dfsg1-1+deb13u11fixed
Debianimagemagickbookworm8:6.9.11.60+dfsg-1.6+deb12u11fixed
Debianimagemagickbookworm-security8:6.9.11.60+dfsg-1.6+deb12u14fixed
Ubuntuimagemagicknoble8:6.9.11.60+dfsg-1.6+deb12u5fixed
Ubuntuimagemagicknoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntuimagemagick-6-commonnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntuimagemagick-6-docnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntuimagemagick-6.q16noble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntuimagemagick-6.q16hdrinoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibimage-magick-perlnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibimage-magick-q16-perlnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibimage-magick-q16hdri-perlnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibmagick++-6-headersnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibmagick++-6.q16-9t64noble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibmagick++-6.q16-devnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibmagick++-6.q16hdri-9t64noble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibmagick++-6.q16hdri-devnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibmagick++-devnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibmagickcore-6-arch-confignoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibmagickcore-6-headersnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibmagickcore-6.q16-7-extranoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibmagickcore-6.q16-7t64noble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibmagickcore-6.q16-devnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibmagickcore-6.q16hdri-7-extranoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibmagickcore-6.q16hdri-7t64noble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibmagickcore-6.q16hdri-devnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibmagickcore-devnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibmagickwand-6-headersnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibmagickwand-6.q16-7t64noble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibmagickwand-6.q16-devnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibmagickwand-6.q16hdri-7t64noble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibmagickwand-6.q16hdri-devnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntulibmagickwand-devnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntuperlmagicknoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
CpeimagemagickNot reported7.1.2-7fixed
Ubuntuimagemagickpro8:6.9.11.60+dfsg-1.6ubuntu1vulnerable
Ubuntuimagemagickpro8:6.9.12.98+dfsg1-5vulnerable
Ubuntuimagemagickpro8:6.9.12.98+dfsg1-5.2build1vulnerable
Ubuntuimagemagickpro8:6.9.12.98+dfsg1-5.2build2vulnerable
Ubuntuimagemagickpro8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm1vulnerable
Ubuntuimagemagickpro8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm2vulnerable
Ubuntuimagemagickpro8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm3vulnerable
Ubuntuimagemagickpro8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntuimagemagickpro8:6.9.11.60+dfsg-1.6ubuntu1vulnerable
Ubuntuimagemagickpro8:6.9.12.98+dfsg1-5vulnerable
Ubuntuimagemagickpro8:6.9.12.98+dfsg1-5.2build1vulnerable
Ubuntuimagemagickpro8:6.9.12.98+dfsg1-5.2build2vulnerable
Ubuntuimagemagickpro8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm1vulnerable
Ubuntuimagemagickpro8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm2vulnerable
Ubuntuimagemagickpro8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm3vulnerable
Ubuntuimagemagickpro8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4fixed
Ubuntuimagemagick25.108:7.1.1.43+dfsg1-1vulnerable
Ubuntuimagemagick25.108:7.1.1.43+dfsg1-1ubuntu1vulnerable
Ubuntuimagemagick25.108:7.1.1.43+dfsg1-1ubuntu2vulnerable
Ubuntuimagemagick25.108:7.1.2.3+dfsg1-1vulnerable
Ubuntuimagemagick25.108:7.1.2.3+dfsg1-1ubuntu0.1vulnerable
Ubuntuimagemagick26.048:7.1.2.3+dfsg1-1vulnerable
Ubuntuimagemagick26.048:7.1.2.8+dfsg1-1fixed
OpensuseImageMagicktumbleweed7.1.2.7-1.1fixed
SuseImageMagicklinux enterprise module for desktop applications 15 sp67.1.1.21-150600.3.26.1fixed
SuseImageMagicklinux enterprise module for development tools 15 sp67.1.1.21-150600.3.26.1fixed
OpensuseImageMagickleap 15.67.1.1.21-150600.3.26.1fixed
SuseImageMagicklinux enterprise module for desktop applications 15 sp77.1.1.43-150700.3.19.1fixed
SuseImageMagicklinux enterprise module for development tools 15 sp77.1.1.43-150700.3.19.1fixed
SuseImageMagicklinux enterprise module for desktop applications 15 sp67.1.0.9-150400.6.46.1fixed
SuseImageMagicklinux enterprise module for desktop applications 15 sp77.1.0.9-150400.6.46.1fixed
SuseImageMagicklinux enterprise server ltss extended security 12 sp56.8.8.1-71.215.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianimagemagicksourcesid8:7.1.2.7+dfsg1-1not yet assignedNot reported[1118340]
Debianimagemagicksourceforky8:7.1.2.7+dfsg1-1not yet assignedNot reported[1118340]
Debianimagemagicksourcetrixie8:7.1.1.43+dfsg1-1+deb13u3not yet assignedNot reported[1118340]
Debianimagemagicksourcebookworm8:6.9.11.60+dfsg-1.6+deb12u5not yet assignedNot reported[1118340]
Ubuntuimagemagickdebnoble8:6.9.11.60+dfsg-1.6+deb12u5Not reportedNot reportedNot reported
Ubuntuimagemagickdebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntuimagemagick-6-commondebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntuimagemagick-6-docdebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntuimagemagick-6.q16debnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntuimagemagick-6.q16hdridebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibimage-magick-perldebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibimage-magick-q16-perldebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibimage-magick-q16hdri-perldebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibmagick++-6-headersdebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibmagick++-6.q16-9t64debnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibmagick++-6.q16-devdebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibmagick++-6.q16hdri-9t64debnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibmagick++-6.q16hdri-devdebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibmagick++-devdebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibmagickcore-6-arch-configdebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibmagickcore-6-headersdebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibmagickcore-6.q16-7-extradebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibmagickcore-6.q16-7t64debnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibmagickcore-6.q16-devdebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibmagickcore-6.q16hdri-7-extradebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibmagickcore-6.q16hdri-7t64debnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibmagickcore-6.q16hdri-devdebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibmagickcore-devdebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibmagickwand-6-headersdebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibmagickwand-6.q16-7t64debnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibmagickwand-6.q16-devdebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibmagickwand-6.q16hdri-7t64debnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibmagickwand-6.q16hdri-devdebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntulibmagickwand-devdebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
Ubuntuperlmagickdebnoble8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedNot reportedNot reported
CpeimagemagickcpeNot reported7.1.2-7Not reportedNVD-CVE-2025-62171Not reported
Ubuntuimagemagickdebpro8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedUSN-7876-1Not reported
Ubuntuimagemagickdebpro8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4Not reportedUBUNTU-CVE-2025-62171Not reported
Ubuntuimagemagickdeb26.048:7.1.2.8+dfsg1-1Not reportedUBUNTU-CVE-2025-62171Not reported
OpensuseImageMagickrpmtumbleweed7.1.2.7-1.1Not reportedOPENSUSE-SU-2025:15650-1Not reported
SuseImageMagickrpmlinux enterprise module for desktop applications 15 sp67.1.1.21-150600.3.26.1Not reportedSUSE-SU-2025:3844-1Not reported
SuseImageMagickrpmlinux enterprise module for development tools 15 sp67.1.1.21-150600.3.26.1Not reportedSUSE-SU-2025:3844-1Not reported
OpensuseImageMagickrpmleap 15.67.1.1.21-150600.3.26.1Not reportedSUSE-SU-2025:3844-1Not reported
SuseImageMagickrpmlinux enterprise module for desktop applications 15 sp77.1.1.43-150700.3.19.1Not reportedSUSE-SU-2025:3867-1Not reported
SuseImageMagickrpmlinux enterprise module for development tools 15 sp77.1.1.43-150700.3.19.1Not reportedSUSE-SU-2025:3867-1Not reported
SuseImageMagickrpmlinux enterprise module for desktop applications 15 sp67.1.0.9-150400.6.46.1Not reportedSUSE-SU-2025:3796-1Not reported
SuseImageMagickrpmlinux enterprise module for desktop applications 15 sp77.1.0.9-150400.6.46.1Not reportedSUSE-SU-2025:3796-1Not reported
SuseImageMagickrpmlinux enterprise server ltss extended security 12 sp56.8.8.1-71.215.1Not reportedSUSE-SU-2025:3918-1Not reported

[Debian bug #1118340]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • Source package: [ImageMagick]

    Details (1)
    • 7.1.2.29-1.2 · noarch · tumbleweed

      Unknown · Fixed: 7.1.2.7-1.1

      Version impact unknown

      usn · ImageMagick · opensuse · tumbleweed

  • Source package: [ImageMagick]

    Details (1)
    • 7.1.2.29-1.1 · noarch · tumbleweed

      Unknown · Fixed: 7.1.2.7-1.1

      Version impact unknown

      usn · ImageMagick · opensuse · tumbleweed

  • Source package: [ImageMagick]

    Details (1)
    • 7.1.2.29-1.1 · noarch · tumbleweed

      Unknown · Fixed: 7.1.2.7-1.1

      Version impact unknown

      usn · ImageMagick · opensuse · tumbleweed

  • Source package: [ImageMagick]

    Details (1)
    • 7.1.2.29-1.1 · noarch · tumbleweed

      Unknown · Fixed: 7.1.2.7-1.1

      Version impact unknown

      usn · ImageMagick · opensuse · tumbleweed

  • Source package: [ImageMagick]

    Details (1)
    • 7.1.2.29-1.1 · noarch · tumbleweed

      Unknown · Fixed: 7.1.2.7-1.1

      Version impact unknown

      usn · ImageMagick · opensuse · tumbleweed

  • Source package: [ImageMagick]

    Details (1)
    • 7.1.2.29-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 7.1.2.7-1.1

      Version impact unknown

      usn · ImageMagick · opensuse · tumbleweed

  • Source package: [ImageMagick]

    Details (1)
    • 7.1.2.29-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 7.1.2.7-1.1

      Version impact unknown

      usn · ImageMagick · opensuse · tumbleweed

  • Source package: [ImageMagick]

    Details (1)
    • 7.1.2.29-1.2 · noarch · tumbleweed

      Unknown · Fixed: 7.1.2.7-1.1

      Version impact unknown

      usn · ImageMagick · opensuse · tumbleweed

  • Source package: [ImageMagick]

    Details (1)
    • 7.1.2.29-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 7.1.2.7-1.1

      Version impact unknown

      usn · ImageMagick · opensuse · tumbleweed

  • Source package: [ImageMagick]

    Details (1)
    • 7.1.2.29-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 7.1.2.7-1.1

      Version impact unknown

      usn · ImageMagick · opensuse · tumbleweed

  • Source package: [ImageMagick]

    Details (1)
    • 7.1.2.29-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 7.1.2.7-1.1

      Version impact unknown

      usn · ImageMagick · opensuse · tumbleweed

  • Source package: [ImageMagick]

    Details (1)
    • 7.1.2.29-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 7.1.2.7-1.1

      Version impact unknown

      usn · ImageMagick · opensuse · tumbleweed

  • Source package: [ImageMagick]

    Details (1)
    • 7.1.2.29-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 7.1.2.7-1.1

      Version impact unknown

      usn · ImageMagick · opensuse · tumbleweed

  • Source package: [ImageMagick]

    Details (1)
    • 7.1.2.29-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 7.1.2.7-1.1

      Version impact unknown

      usn · ImageMagick · opensuse · tumbleweed

  • Source package: [ImageMagick]

    Details (1)
    • 7.1.2.29-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 7.1.2.7-1.1

      Version impact unknown

      usn · ImageMagick · opensuse · tumbleweed

  • Source package: [ImageMagick]

    Details (1)
    • 7.1.2.29-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 7.1.2.7-1.1

      Version impact unknown

      usn · ImageMagick · opensuse · tumbleweed

  • Source package: [ImageMagick]

    Details (1)
    • 7.1.2.29-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 7.1.2.7-1.1

      Version impact unknown

      usn · ImageMagick · opensuse · tumbleweed

  • Source package: [ImageMagick]

    Details (1)
    • 7.1.2.29-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 7.1.2.7-1.1

      Version impact unknown

      usn · ImageMagick · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • Details (4)
    • 8:6.9.11.60+dfsg-1.6+deb12u11 · amd64 · bookworm

      Fixed · Fixed: 8:6.9.11.60+dfsg-1.6+deb12u5

      usn · imagemagick · debian · bookworm; usn · imagemagick · debian · 12

    • 8:6.9.11.60+dfsg-1.6+deb12u11 · arm64 · bookworm

      Fixed · Fixed: 8:6.9.11.60+dfsg-1.6+deb12u5

      usn · imagemagick · debian · bookworm; usn · imagemagick · debian · 12

    • 8:6.9.11.60+dfsg-1.6+deb12u13 · amd64 · bookworm-security

      Fixed · Fixed: 8:6.9.11.60+dfsg-1.6+deb12u5

      usn · imagemagick · debian · bookworm; usn · imagemagick · debian · 12

    • 8:6.9.11.60+dfsg-1.6+deb12u13 · arm64 · bookworm-security

      Fixed · Fixed: 8:6.9.11.60+dfsg-1.6+deb12u5

      usn · imagemagick · debian · bookworm; usn · imagemagick · debian · 12

  • Source package: [imagemagick]

    Details (4)
    • 8:6.9.11.60+dfsg-1.6+deb12u11 · all · bookworm

      Fixed · Fixed: 8:6.9.11.60+dfsg-1.6+deb12u5

      usn · imagemagick · debian · bookworm; usn · imagemagick · debian · 12

    • 8:6.9.11.60+dfsg-1.6+deb12u11 · all · bookworm

      Fixed · Fixed: 8:6.9.11.60+dfsg-1.6+deb12u5

      usn · imagemagick · debian · bookworm; usn · imagemagick · debian · 12

    • 8:6.9.11.60+dfsg-1.6+deb12u13 · all · bookworm-security

      Fixed · Fixed: 8:6.9.11.60+dfsg-1.6+deb12u5

      usn · imagemagick · debian · bookworm; usn · imagemagick · debian · 12

    • 8:6.9.11.60+dfsg-1.6+deb12u13 · all · bookworm-security

      Fixed · Fixed: 8:6.9.11.60+dfsg-1.6+deb12u5

      usn · imagemagick · debian · bookworm; usn · imagemagick · debian · 12

Next results

Observed:

References