Introduction
Malicious image files can compromise web servers and backend systems that rely on automated image processing. CVE-2025-55154 exposes a critical weakness in ImageMagick, a library used around the world to edit and convert digital images in web applications, content management systems, and cloud services.
ImageMagick is a widely used open-source graphics project. It is built into thousands of products and platforms, where it handles jobs such as social media uploads and document conversion pipelines. Its security problems therefore reach a wide range of industries and users.
Technical Information
CVE-2025-55154 is a memory corruption vulnerability in ImageMagick's implementation of the MNG (Multiple-image Network Graphics) format. The flaw is in the ReadOneMNGImage function in the coders/png.c source file, where unsafe magnified size calculations can overflow integer boundaries. When ImageMagick processes a specially crafted MNG file, arithmetic on the image dimensions or related parameters can exceed the largest value the integer type in use can hold.
The overflow produces incorrect buffer sizes. Later memory allocations may then be too small for the data being processed, which corrupts the heap. The vulnerability is classified as CWE-190 (Integer Overflow or Wraparound). An attacker can exploit it by submitting a malicious MNG image to a system that runs a vulnerable ImageMagick version, with arbitrary code execution or an application crash as the possible result.
At the time of writing, no vulnerable code snippet for this issue is public. Google's Big Sleep AI research initiative found the vulnerability through automated analysis.
Affected Systems and Versions
- ImageMagick versions prior to 6.9.13-27 (6.x branch)
- ImageMagick versions prior to 7.1.2-1 (7.x branch)
- Any configuration that processes MNG images with an affected version is vulnerable
Vendor Security History
ImageMagick has a history of vulnerabilities involving memory safety, integer overflows, and the parsing of complex image formats. Previous issues include:
- CVE-2022-32546: Integer overflow in coders/pcl.c
- CVE-2020-27768: Integer overflow in MagickCore/quantum-private.h
- Multiple advisories published on the ImageMagick GitHub Security page
The project usually publishes advisories and patches promptly once a vulnerability is reported. It is maintained by a global community of contributors.
