Introduction
A subtle memory-handling flaw in an image conversion pipeline can leak sensitive data into output files. Where user-supplied images are processed automatically, a leak like this can undermine data confidentiality without any obvious sign of compromise.
ImageMagick is a free, open-source image manipulation suite used in web servers, content management systems, and cloud platforms around the world. It supports over 200 image formats and is a core component of many automated image processing workflows. Its wide adoption and complex codebase make it a frequent target for security researchers looking for vulnerabilities.
Technical information
CVE-2025-55004 is a heap buffer overflow read in ImageMagick's ReadOneMNGImage function. It affects versions prior to 7.1.2-1 and is triggered when ImageMagick magnifies an MNG (Multiple-image Network Graphics) image that contains a separate alpha channel. During magnification, the function does not enforce buffer boundaries correctly when it handles pixel and alpha channel data. It reads out of bounds on the heap, and memory next to the intended buffer ends up in the output image.
The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow). The root cause is insufficient bounds checking when pixel and alpha channel data are scaled. MNG images with separate alpha channels need careful memory management, and the complexity of that work has produced similar bugs before. CVE-2017-17879, for example, was also a heap buffer over-read in the same function, which shows how persistent the problem of processing this format safely has been.
As of the publication date, no public code snippets or proof-of-concept exploits have been released for this vulnerability.
Affected systems and versions
- ImageMagick versions prior to 7.1.2-1 are affected
- The flaw specifically affects systems that process MNG images with separate alpha channels
- Any configuration that uses a vulnerable ImageMagick version for automated or user-driven image magnification is at risk
Vendor security history
ImageMagick has a long history of memory safety issues, particularly in its image parsing and processing routines. ReadOneMNGImage itself has had earlier vulnerabilities, such as CVE-2017-17879, which was also a heap buffer over-read. The ImageMagick team maintains a public security advisory system and generally responds promptly to vulnerability reports. Even so, the complexity of supporting so many image formats keeps producing new security issues.
