Zetlyn
GitHubGet started

ImageMagick: ImageMagick Integer Overflow leading to out of bounds read (32-bit only)

cve CVE-2025-66628 2 sources, 2 claims · Watch

Red Hat writes:
ImageMagick: ImageMagick Integer Overflow leading to out of bounds read (32-bit only) the claim
Severity
HIGH NVD
important Red Hat
CVSS
7.5 NVD
7.5 Red Hat
Vendor
ImageMagick NVD
Product
ImageMagick NVD
CWE
CWE-125 NVD
CWE-125 Red Hat

How far exploitation has got

  1. No public code known
  2. Proof of concept
  3. Proof of concept, verified
  4. A Metasploit module
  5. Exploited in the wild
  6. Used in ransomware campaigns

Timeline

2025-12-10first spoke of it: ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10.NVD
2025-12-10first spoke of it: ImageMagick: ImageMagick Integer Overflow leading to out of bounds read (32-bit only)Red Hat

What it is to other things

affectsimagemagick/imagemagick
NVD
made_byimagemagick
NVD
Every value, with what each source said and its receipt
PropertySourceSaidMeans here
Automatable
automatable
NVDyes
An attacker can reliably run all of the kill chain's first four steps without a person.
receipt
Source
NVD
Its words
yes
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].automatable
Said since
2026-10-06 12:29 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:29 UTCyes
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "ImageMagick",
            "vendor": "ImageMagick",
            "versions": [
              {
                "status": "affected",
                "version": "< 7.1.2-10"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "189F420B-9B0E-4AB1-9D20-3D7E5ACCBDEE",
                "versionEndExcluding": "7.1.2-10",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10."
      },
      {
        "lang": "es",
        "value": "ImageMagick es una suite de software para crear, editar, componer o convertir imágenes de mapa de bits. En las versiones 7.1.2-9 y anteriores, el analizador de imágenes TIM (PSX TIM) contiene una vulnerabilidad crítica de desbordamiento de entero en su función ReadTIMImage (coders/tim.c). El código lee el ancho y el alto (valores de 16 bits) del encabezado del archivo y calcula image_size = 2 * width * height sin verificar si hay desbordamiento. En sistemas de 32 bits (o donde size_t es de 32 bits), este cálculo puede desbordarse si el ancho y el alto son grandes (por ejemplo, 65535), envolviéndose a un valor pequeño. Esto resulta en una pequeña asignación de memoria en el heap a través de AcquireQuantumMemory y operaciones posteriores que dependen de las dimensiones pueden desencadenar una lectura fuera de límites. Este problema se corrige en la versión 7.1.2-10."
      }
    ],
    "id": "CVE-2025-66628",
    "lastModified": "2026-09-25T23:10:00.463",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-66628",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-11T15:38:44.136255Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-10T22:16:28.660",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/dlemstra/Magick.NET/commit/2dfa08e15cfd11016a79615994787b14f9048b1c"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-125"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
CVSS
cvss
NVD7.5
receipt
Source
NVD
Its words
7.5
Read by
field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseScore || field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since
2026-09-29 09:45 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "ImageMagick",
            "vendor": "ImageMagick",
            "versions": [
              {
                "status": "affected",
                "version": "< 7.1.2-10"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "189F420B-9B0E-4AB1-9D20-3D7E5ACCBDEE",
                "versionEndExcluding": "7.1.2-10",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10."
      },
      {
        "lang": "es",
        "value": "ImageMagick es una suite de software para crear, editar, componer o convertir imágenes de mapa de bits. En las versiones 7.1.2-9 y anteriores, el analizador de imágenes TIM (PSX TIM) contiene una vulnerabilidad crítica de desbordamiento de entero en su función ReadTIMImage (coders/tim.c). El código lee el ancho y el alto (valores de 16 bits) del encabezado del archivo y calcula image_size = 2 * width * height sin verificar si hay desbordamiento. En sistemas de 32 bits (o donde size_t es de 32 bits), este cálculo puede desbordarse si el ancho y el alto son grandes (por ejemplo, 65535), envolviéndose a un valor pequeño. Esto resulta en una pequeña asignación de memoria en el heap a través de AcquireQuantumMemory y operaciones posteriores que dependen de las dimensiones pueden desencadenar una lectura fuera de límites. Este problema se corrige en la versión 7.1.2-10."
      }
    ],
    "id": "CVE-2025-66628",
    "lastModified": "2026-09-25T23:10:00.463",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-66628",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-11T15:38:44.136255Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-10T22:16:28.660",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/dlemstra/Magick.NET/commit/2dfa08e15cfd11016a79615994787b14f9048b1c"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-125"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
CVSS
cvss
Red Hat7.5
receipt
Source
Red Hat
Its words
7.5
Read by
field:cvss3_score
Said since
2026-09-29 09:44 UTC
Last answered
2026-10-06 13:02 UTC
Original
open at the source
What the source handed over
{
  "CVE": "CVE-2025-66628",
  "CWE": "CWE-125",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2421159",
  "bugzilla_description": "ImageMagick: ImageMagick Integer Overflow leading to out of bounds read (32-bit only)",
  "cvss3_score": "7.5",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2025-12-10T22:04:49Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-66628.json",
  "severity": "important"
}
—
CVSS vector
cvss_vector
NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
receipt
Source
NVD
Its words
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Read by
field:cve.metrics.cvssMetricV31[type=Primary].cvssData.vectorString || field:cve.metrics.cvssMetricV31[].cvssData.vectorString
Said since
2026-10-06 12:29 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:29 UTCCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "ImageMagick",
            "vendor": "ImageMagick",
            "versions": [
              {
                "status": "affected",
                "version": "< 7.1.2-10"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "189F420B-9B0E-4AB1-9D20-3D7E5ACCBDEE",
                "versionEndExcluding": "7.1.2-10",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10."
      },
      {
        "lang": "es",
        "value": "ImageMagick es una suite de software para crear, editar, componer o convertir imágenes de mapa de bits. En las versiones 7.1.2-9 y anteriores, el analizador de imágenes TIM (PSX TIM) contiene una vulnerabilidad crítica de desbordamiento de entero en su función ReadTIMImage (coders/tim.c). El código lee el ancho y el alto (valores de 16 bits) del encabezado del archivo y calcula image_size = 2 * width * height sin verificar si hay desbordamiento. En sistemas de 32 bits (o donde size_t es de 32 bits), este cálculo puede desbordarse si el ancho y el alto son grandes (por ejemplo, 65535), envolviéndose a un valor pequeño. Esto resulta en una pequeña asignación de memoria en el heap a través de AcquireQuantumMemory y operaciones posteriores que dependen de las dimensiones pueden desencadenar una lectura fuera de límites. Este problema se corrige en la versión 7.1.2-10."
      }
    ],
    "id": "CVE-2025-66628",
    "lastModified": "2026-09-25T23:10:00.463",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-66628",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-11T15:38:44.136255Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-10T22:16:28.660",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/dlemstra/Magick.NET/commit/2dfa08e15cfd11016a79615994787b14f9048b1c"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-125"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
CVSS vector
cvss_vector
Red HatCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
receipt
Source
Red Hat
Its words
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Read by
field:cvss3_scoring_vector
Said since
2026-10-06 13:01 UTC
Last answered
2026-10-06 13:02 UTC
Original
open at the source
2026-10-06 13:01 UTCCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2026-09-29 09:44 UTC—
What the source handed over
{
  "CVE": "CVE-2025-66628",
  "CWE": "CWE-125",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2421159",
  "bugzilla_description": "ImageMagick: ImageMagick Integer Overflow leading to out of bounds read (32-bit only)",
  "cvss3_score": "7.5",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2025-12-10T22:04:49Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-66628.json",
  "severity": "important"
}
—
CWE
cwe
NVDCWE-125
receipt
Source
NVD
Its words
CWE-125
Read by
field:cve.weaknesses[].description[].value
Said since
2026-10-06 12:29 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:29 UTCCWE-125
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "ImageMagick",
            "vendor": "ImageMagick",
            "versions": [
              {
                "status": "affected",
                "version": "< 7.1.2-10"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "189F420B-9B0E-4AB1-9D20-3D7E5ACCBDEE",
                "versionEndExcluding": "7.1.2-10",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10."
      },
      {
        "lang": "es",
        "value": "ImageMagick es una suite de software para crear, editar, componer o convertir imágenes de mapa de bits. En las versiones 7.1.2-9 y anteriores, el analizador de imágenes TIM (PSX TIM) contiene una vulnerabilidad crítica de desbordamiento de entero en su función ReadTIMImage (coders/tim.c). El código lee el ancho y el alto (valores de 16 bits) del encabezado del archivo y calcula image_size = 2 * width * height sin verificar si hay desbordamiento. En sistemas de 32 bits (o donde size_t es de 32 bits), este cálculo puede desbordarse si el ancho y el alto son grandes (por ejemplo, 65535), envolviéndose a un valor pequeño. Esto resulta en una pequeña asignación de memoria en el heap a través de AcquireQuantumMemory y operaciones posteriores que dependen de las dimensiones pueden desencadenar una lectura fuera de límites. Este problema se corrige en la versión 7.1.2-10."
      }
    ],
    "id": "CVE-2025-66628",
    "lastModified": "2026-09-25T23:10:00.463",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-66628",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-11T15:38:44.136255Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-10T22:16:28.660",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/dlemstra/Magick.NET/commit/2dfa08e15cfd11016a79615994787b14f9048b1c"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-125"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
CWE
cwe
Red HatCWE-125
receipt
Source
Red Hat
Its words
CWE-125
Read by
field:CWE
Said since
2026-09-29 09:44 UTC
Last answered
2026-10-06 13:02 UTC
Original
open at the source
What the source handed over
{
  "CVE": "CVE-2025-66628",
  "CWE": "CWE-125",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2421159",
  "bugzilla_description": "ImageMagick: ImageMagick Integer Overflow leading to out of bounds read (32-bit only)",
  "cvss3_score": "7.5",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2025-12-10T22:04:49Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-66628.json",
  "severity": "important"
}
—
Exploitation
exploitation
NVDnone
No evidence of exploitation, and no public proof of concept.
receipt
Source
NVD
Its words
none
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].exploitation
Said since
2026-10-06 12:29 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:29 UTCnone
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "ImageMagick",
            "vendor": "ImageMagick",
            "versions": [
              {
                "status": "affected",
                "version": "< 7.1.2-10"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "189F420B-9B0E-4AB1-9D20-3D7E5ACCBDEE",
                "versionEndExcluding": "7.1.2-10",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10."
      },
      {
        "lang": "es",
        "value": "ImageMagick es una suite de software para crear, editar, componer o convertir imágenes de mapa de bits. En las versiones 7.1.2-9 y anteriores, el analizador de imágenes TIM (PSX TIM) contiene una vulnerabilidad crítica de desbordamiento de entero en su función ReadTIMImage (coders/tim.c). El código lee el ancho y el alto (valores de 16 bits) del encabezado del archivo y calcula image_size = 2 * width * height sin verificar si hay desbordamiento. En sistemas de 32 bits (o donde size_t es de 32 bits), este cálculo puede desbordarse si el ancho y el alto son grandes (por ejemplo, 65535), envolviéndose a un valor pequeño. Esto resulta en una pequeña asignación de memoria en el heap a través de AcquireQuantumMemory y operaciones posteriores que dependen de las dimensiones pueden desencadenar una lectura fuera de límites. Este problema se corrige en la versión 7.1.2-10."
      }
    ],
    "id": "CVE-2025-66628",
    "lastModified": "2026-09-25T23:10:00.463",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-66628",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-11T15:38:44.136255Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-10T22:16:28.660",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/dlemstra/Magick.NET/commit/2dfa08e15cfd11016a79615994787b14f9048b1c"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-125"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Product
product
NVDImageMagick
receipt
Source
NVD
Its words
ImageMagick
Read by
field:cve.affected[].affectedData[].product
Said since
2026-09-29 17:49 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-09-29 17:49 UTCImageMagick
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "ImageMagick",
            "vendor": "ImageMagick",
            "versions": [
              {
                "status": "affected",
                "version": "< 7.1.2-10"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "189F420B-9B0E-4AB1-9D20-3D7E5ACCBDEE",
                "versionEndExcluding": "7.1.2-10",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10."
      },
      {
        "lang": "es",
        "value": "ImageMagick es una suite de software para crear, editar, componer o convertir imágenes de mapa de bits. En las versiones 7.1.2-9 y anteriores, el analizador de imágenes TIM (PSX TIM) contiene una vulnerabilidad crítica de desbordamiento de entero en su función ReadTIMImage (coders/tim.c). El código lee el ancho y el alto (valores de 16 bits) del encabezado del archivo y calcula image_size = 2 * width * height sin verificar si hay desbordamiento. En sistemas de 32 bits (o donde size_t es de 32 bits), este cálculo puede desbordarse si el ancho y el alto son grandes (por ejemplo, 65535), envolviéndose a un valor pequeño. Esto resulta en una pequeña asignación de memoria en el heap a través de AcquireQuantumMemory y operaciones posteriores que dependen de las dimensiones pueden desencadenar una lectura fuera de límites. Este problema se corrige en la versión 7.1.2-10."
      }
    ],
    "id": "CVE-2025-66628",
    "lastModified": "2026-09-25T23:10:00.463",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-66628",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-11T15:38:44.136255Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-10T22:16:28.660",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/dlemstra/Magick.NET/commit/2dfa08e15cfd11016a79615994787b14f9048b1c"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-125"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Severity
severity
NVDHIGH
From 7.0 to 8.9.
receipt
Source
NVD
Its words
HIGH
Read by
field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseSeverity || field:cve.metrics.cvssMetricV31[].cvssData.baseSeverity
Said since
2026-10-06 12:29 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:29 UTCHIGH
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "ImageMagick",
            "vendor": "ImageMagick",
            "versions": [
              {
                "status": "affected",
                "version": "< 7.1.2-10"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "189F420B-9B0E-4AB1-9D20-3D7E5ACCBDEE",
                "versionEndExcluding": "7.1.2-10",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10."
      },
      {
        "lang": "es",
        "value": "ImageMagick es una suite de software para crear, editar, componer o convertir imágenes de mapa de bits. En las versiones 7.1.2-9 y anteriores, el analizador de imágenes TIM (PSX TIM) contiene una vulnerabilidad crítica de desbordamiento de entero en su función ReadTIMImage (coders/tim.c). El código lee el ancho y el alto (valores de 16 bits) del encabezado del archivo y calcula image_size = 2 * width * height sin verificar si hay desbordamiento. En sistemas de 32 bits (o donde size_t es de 32 bits), este cálculo puede desbordarse si el ancho y el alto son grandes (por ejemplo, 65535), envolviéndose a un valor pequeño. Esto resulta en una pequeña asignación de memoria en el heap a través de AcquireQuantumMemory y operaciones posteriores que dependen de las dimensiones pueden desencadenar una lectura fuera de límites. Este problema se corrige en la versión 7.1.2-10."
      }
    ],
    "id": "CVE-2025-66628",
    "lastModified": "2026-09-25T23:10:00.463",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-66628",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-11T15:38:44.136255Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-10T22:16:28.660",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/dlemstra/Magick.NET/commit/2dfa08e15cfd11016a79615994787b14f9048b1c"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-125"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
high
Severity
severity
Red Hatimportant
A flaw that can easily compromise confidentiality, integrity or availability.
receipt
Source
Red Hat
Its words
important
Read by
field:severity
Said since
2026-09-29 09:44 UTC
Last answered
2026-10-06 13:02 UTC
Original
open at the source
What the source handed over
{
  "CVE": "CVE-2025-66628",
  "CWE": "CWE-125",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2421159",
  "bugzilla_description": "ImageMagick: ImageMagick Integer Overflow leading to out of bounds read (32-bit only)",
  "cvss3_score": "7.5",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2025-12-10T22:04:49Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-66628.json",
  "severity": "important"
}
high
Status
status
NVDAnalyzed
receipt
Source
NVD
Its words
Analyzed
Read by
field:cve.vulnStatus
Said since
2026-09-29 09:45 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "ImageMagick",
            "vendor": "ImageMagick",
            "versions": [
              {
                "status": "affected",
                "version": "< 7.1.2-10"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "189F420B-9B0E-4AB1-9D20-3D7E5ACCBDEE",
                "versionEndExcluding": "7.1.2-10",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10."
      },
      {
        "lang": "es",
        "value": "ImageMagick es una suite de software para crear, editar, componer o convertir imágenes de mapa de bits. En las versiones 7.1.2-9 y anteriores, el analizador de imágenes TIM (PSX TIM) contiene una vulnerabilidad crítica de desbordamiento de entero en su función ReadTIMImage (coders/tim.c). El código lee el ancho y el alto (valores de 16 bits) del encabezado del archivo y calcula image_size = 2 * width * height sin verificar si hay desbordamiento. En sistemas de 32 bits (o donde size_t es de 32 bits), este cálculo puede desbordarse si el ancho y el alto son grandes (por ejemplo, 65535), envolviéndose a un valor pequeño. Esto resulta en una pequeña asignación de memoria en el heap a través de AcquireQuantumMemory y operaciones posteriores que dependen de las dimensiones pueden desencadenar una lectura fuera de límites. Este problema se corrige en la versión 7.1.2-10."
      }
    ],
    "id": "CVE-2025-66628",
    "lastModified": "2026-09-25T23:10:00.463",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-66628",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-11T15:38:44.136255Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-10T22:16:28.660",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/dlemstra/Magick.NET/commit/2dfa08e15cfd11016a79615994787b14f9048b1c"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-125"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Technical impact
technical_impact
NVDpartial
The attacker gains limited control, or limited information.
receipt
Source
NVD
Its words
partial
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].technicalImpact
Said since
2026-10-06 12:29 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:29 UTCpartial
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "ImageMagick",
            "vendor": "ImageMagick",
            "versions": [
              {
                "status": "affected",
                "version": "< 7.1.2-10"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "189F420B-9B0E-4AB1-9D20-3D7E5ACCBDEE",
                "versionEndExcluding": "7.1.2-10",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10."
      },
      {
        "lang": "es",
        "value": "ImageMagick es una suite de software para crear, editar, componer o convertir imágenes de mapa de bits. En las versiones 7.1.2-9 y anteriores, el analizador de imágenes TIM (PSX TIM) contiene una vulnerabilidad crítica de desbordamiento de entero en su función ReadTIMImage (coders/tim.c). El código lee el ancho y el alto (valores de 16 bits) del encabezado del archivo y calcula image_size = 2 * width * height sin verificar si hay desbordamiento. En sistemas de 32 bits (o donde size_t es de 32 bits), este cálculo puede desbordarse si el ancho y el alto son grandes (por ejemplo, 65535), envolviéndose a un valor pequeño. Esto resulta en una pequeña asignación de memoria en el heap a través de AcquireQuantumMemory y operaciones posteriores que dependen de las dimensiones pueden desencadenar una lectura fuera de límites. Este problema se corrige en la versión 7.1.2-10."
      }
    ],
    "id": "CVE-2025-66628",
    "lastModified": "2026-09-25T23:10:00.463",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-66628",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-11T15:38:44.136255Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-10T22:16:28.660",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/dlemstra/Magick.NET/commit/2dfa08e15cfd11016a79615994787b14f9048b1c"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-125"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Vendor
vendor
NVDImageMagick
receipt
Source
NVD
Its words
ImageMagick
Read by
field:cve.affected[].affectedData[].vendor
Said since
2026-09-29 17:49 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-09-29 17:49 UTCImageMagick
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "ImageMagick",
            "vendor": "ImageMagick",
            "versions": [
              {
                "status": "affected",
                "version": "< 7.1.2-10"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "189F420B-9B0E-4AB1-9D20-3D7E5ACCBDEE",
                "versionEndExcluding": "7.1.2-10",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10."
      },
      {
        "lang": "es",
        "value": "ImageMagick es una suite de software para crear, editar, componer o convertir imágenes de mapa de bits. En las versiones 7.1.2-9 y anteriores, el analizador de imágenes TIM (PSX TIM) contiene una vulnerabilidad crítica de desbordamiento de entero en su función ReadTIMImage (coders/tim.c). El código lee el ancho y el alto (valores de 16 bits) del encabezado del archivo y calcula image_size = 2 * width * height sin verificar si hay desbordamiento. En sistemas de 32 bits (o donde size_t es de 32 bits), este cálculo puede desbordarse si el ancho y el alto son grandes (por ejemplo, 65535), envolviéndose a un valor pequeño. Esto resulta en una pequeña asignación de memoria en el heap a través de AcquireQuantumMemory y operaciones posteriores que dependen de las dimensiones pueden desencadenar una lectura fuera de límites. Este problema se corrige en la versión 7.1.2-10."
      }
    ],
    "id": "CVE-2025-66628",
    "lastModified": "2026-09-25T23:10:00.463",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-66628",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-11T15:38:44.136255Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-10T22:16:28.660",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/dlemstra/Magick.NET/commit/2dfa08e15cfd11016a79615994787b14f9048b1c"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-125"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Every claim, by kind

vulnerability

ImageMagick: ImageMagick Integer Overflow leading to out of bounds read (32-bit only)
zetlyn/cve-redhat · 2025-12-10
cvss 7.5 cvss_vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cwe CWE-125 severity important source
ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10.
zetlyn/cve-nvd · 2025-12-10
automatable yes cvss 7.5 cvss_vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cwe CWE-125 exploitation none product ImageMagick severity HIGH status Analyzed technical_impact partial vendor ImageMagick source