CVE-2025-57807: ImageMagick BlobStream Forward-Seek Under-Allocation
(updated )
For memory-backed blobs (BlobStream), SeekBlob() permits advancing the stream offset beyond the current end without increasing capacity. The subsequent WriteBlob() then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset ≫ extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 2⁶⁴ arithmetic wrap, external delegates, or policy settings are required.
References
- github.com/ImageMagick/ImageMagick
- github.com/ImageMagick/ImageMagick/commit/077a417a19a5ea8c85559b602754a5b928eef23e
- github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6-hqfg
- github.com/advisories/GHSA-23hg-53q6-hqfg
- lists.debian.org/debian-lts-announce/2025/09/msg00012.html
- nvd.nist.gov/vuln/detail/CVE-2025-57807
Code Behaviors & Features
Detect and mitigate CVE-2025-57807 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →