CVE-2025-55160: ImageMagick has Undefined Behavior (function-type-mismatch) in CloneSplayTree

August 25, 2025

Target: ImageMagick (commit ecc9a5eb456747374bae8e07038ba10b3d8821b3)
Type: Undefined Behavior (function-type-mismatch) in splay tree cloning callback
Impact: Deterministic abort under UBSan (DoS in sanitizer builds). No crash in a non-sanitized build; likely low security impact.
Trigger: Minimal 2-byte input parsed via MagickWand, then coalescing.

References

github.com/ImageMagick/ImageMagick
github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hgw-6x87-578x
github.com/advisories/GHSA-6hgw-6x87-578x
github.com/dlemstra/Magick.NET/releases/tag/14.8.0
nvd.nist.gov/vuln/detail/CVE-2025-55160

Code Behaviors & Features

Detect and mitigate CVE-2025-55160 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →