CVE-2025-62171

Ecosystem	Package	Version

Vulnerabilities

CVE-2025-62171

ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. The vulnerability is fixed in versions 7.1.2-7 and 6.9.13-32.

Published Oct 22, 2025

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9pp9-cfwx-54rm

CVSS ScoreHigh

7.5


cocoapods	ImageMagick	6.8.1-0
cocoapods	ImageMagick	6.8.8-9
rpm	ImageMagick	0
rpm	ImageMagick	1
rpm	ImageMagick	6.5.4.7-5.el6
rpm	ImageMagick	6.5.4.7-6.el6_2
rpm	ImageMagick	6.5.4.7-7.el6_5
rpm	ImageMagick	6.7.2.7-2.el6
rpm	ImageMagick	6.7.2.7-4.el6_7
rpm	ImageMagick	6.7.2.7-5.0.2.el6_8
rpm	ImageMagick	6.7.2.7-5.el6_8
rpm	ImageMagick	6.7.2.7-6.el6
rpm	ImageMagick	6.7.8.9-10.el7
rpm	ImageMagick	6.7.8.9-12.el7_2
rpm	ImageMagick	6.7.8.9-13.el7_2
rpm	ImageMagick	6.7.8.9-15.el7_2
rpm	ImageMagick	6.7.8.9-16.el7_6
rpm	ImageMagick	6.7.8.9-18.el7
rpm	ImageMagick	6.9.10.68-3.el7
rpm	ImageMagick	6.9.10.68-4.el7
rpm	ImageMagick	6.9.10.68-5.el7_9
rpm	ImageMagick	6.9.10.68-6.el7_9
rpm	ImageMagick	6.9.10.68-7.el7_9
rpm	ImageMagick-c++	0
rpm	ImageMagick-c++	1
rpm	ImageMagick-c++	6.5.4.7-5.el6
rpm	ImageMagick-c++	6.5.4.7-6.el6_2
rpm	ImageMagick-c++	6.5.4.7-7.el6_5
rpm	ImageMagick-c++	6.7.2.7-2.el6
rpm	ImageMagick-c++	6.7.2.7-4.el6_7
rpm	ImageMagick-c++	6.7.2.7-5.0.2.el6_8
rpm	ImageMagick-c++	6.7.2.7-5.el6_8
rpm	ImageMagick-c++	6.7.2.7-6.el6
rpm	ImageMagick-c++	6.7.8.9-10.el7
rpm	ImageMagick-c++	6.7.8.9-12.el7_2
rpm	ImageMagick-c++	6.7.8.9-13.el7_2
rpm	ImageMagick-c++	6.7.8.9-15.el7_2
rpm	ImageMagick-c++	6.7.8.9-16.el7_6
rpm	ImageMagick-c++	6.7.8.9-18.el7
rpm	ImageMagick-c++	6.9.10.68-3.el7
rpm	ImageMagick-c++	6.9.10.68-4.el7
rpm	ImageMagick-c++	6.9.10.68-5.el7_9
rpm	ImageMagick-c++	6.9.10.68-6.el7_9
rpm	ImageMagick-c++	6.9.10.68-7.el7_9
rpm	ImageMagick-c++-debuginfo	0
rpm	ImageMagick-c++-debuginfo	1
rpm	ImageMagick-c++-devel	0
rpm	ImageMagick-c++-devel	1
rpm	ImageMagick-c++-devel	6.5.4.7-5.el6
rpm	ImageMagick-c++-devel	6.5.4.7-6.el6_2

Ecosystem	Package	Version

CVE-2025-62171 | Components Impacted | Sonatype Guide | Sonatype Guide

Find vulnerabilities. Fix fast with AI.

CVE-2025-62171