CVE-2025-62171: ImageMagick has Integer Overflow in BMP Decoder (ReadBMP)
(updated )
CVE-2025-57803 claims to be patched in ImageMagick 7.1.2-2, but the fix is incomplete and ineffective. The latest version 7.1.2-5 remains vulnerable to the same integer overflow attack.
The patch added BMPOverflowCheck() but placed it after the overflow occurs, making it useless. A malicious 58-byte BMP file can trigger AddressSanitizer crashes and DoS.
Affected Versions:
- ImageMagick < 7.1.2-2 (originally reported)
- ImageMagick 7.1.2-2 through 7.1.2-5 (incomplete patch)
Platform and Configuration Requirements:
- 32-bit systems ONLY (i386, i686, armv7l, etc.)
- Requires
size_t = 4 bytes. (64-bit systems are NOT vulnerable (size_t = 8 bytes)) - Requires modified resource limits: The default
width,height, andarealimits must have been manually increased (Systems using default ImageMagick resource limits are NOT vulnerable).
References
- github.com/ImageMagick/ImageMagick
- github.com/ImageMagick/ImageMagick/commit/cea1693e2ded51b4cc91c70c54096cbed1691c00
- github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9pp9-cfwx-54rm
- github.com/advisories/GHSA-9pp9-cfwx-54rm
- github.com/dlemstra/Magick.NET/releases/tag/14.9.0
- lists.debian.org/debian-lts-announce/2025/10/msg00019.html
- nvd.nist.gov/vuln/detail/CVE-2025-62171
Code Behaviors & Features
Detect and mitigate CVE-2025-62171 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →