CVE-2025-53101: ImageMagick has a Stack Buffer Overflow in image.c
In ImageMagick’s magick mogrify command, specifying multiple consecutive %d format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through vsnprintf().
References
- github.com/ImageMagick/ImageMagick
- github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774
- github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh3h-j545-h8c9
- github.com/ImageMagick/ImageMagick6/commit/643deeb60803488373cd4799b24d5786af90972e
- github.com/advisories/GHSA-qh3h-j545-h8c9
- github.com/dlemstra/Magick.NET/releases/tag/14.7.0
- nvd.nist.gov/vuln/detail/CVE-2025-53101
Code Behaviors & Features
Detect and mitigate CVE-2025-53101 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →