Sign in
Deutsch English Español Polski
Low

ImageMagick has a Heap Buffer Overflow in InterpretImageFilename

  • Disclosed: 25.08.2025
  • Updated: 11.10.2026 11:23

Heap Buffer Overflow in InterpretImageFilename

Summary

A heap buffer overflow was identified in the InterpretImageFilename function of ImageMagick. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (%%).

Environment

  • OS: Arch Linux (Linux gmkhost 6.14.2-arch1-1 # 1 SMP PREEMPT_DYNAMIC Thu, 10 Apr 2025 18:43:59 +0000 x86_64 GNU/Linux (GNU libc) 2.41)
  • Architecture: x86_64
  • Compiler: gcc (GCC) 15.1.1 20250425

Reproduction

Build Instructions

bash
# Clone the repository
git clone https://github.com/ImageMagick/ImageMagick.git
cd ImageMagick
git reset --hard 8fff9b4f44d2e8b5cae2bd6db70930a144d15f12

# Build with AddressSanitizer
export CFLAGS="-fsanitize=address -g -O1"
export CXXFLAGS="-fsanitize=address -g -O1"
export LDFLAGS="-fsanitizer=address"
./configure
make

# Set library path and trigger the crash
export LD_LIBRARY_PATH="$(pwd)/MagickWand/.libs:$(pwd)/MagickCore/.libs:$LD_LIBRARY_PATH"
./utilities/.libs/magick %% a

Minimum Trigger

bash
./utilities/.libs/magick %% [any_output_filename]

Crash Analysis

AddressSanitizer Output

bash
$ ./utilities/.libs/magick %% a
=================================================================
==2227694==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7037f99e3ad3 at pc 0x741801e81a17 bp 0x7ffd22fa4e00 sp 0x7ffd22fa45b8
READ of size 1 at 0x7037f99e3ad3 thread T0
    #0 0x741801e81a16 in strchr /usr/src/debug/gcc/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:746
    #1 0x7418013b4f06 in InterpretImageFilename MagickCore/image.c:1674
    #2 0x7418012826a3 in ReadImages MagickCore/constitute.c:1040
    #3 0x741800e4696b in CLINoImageOperator MagickWand/operation.c:4959
    #4 0x741800e64de7 in CLIOption MagickWand/operation.c:5473
    #5 0x741800d92edf in ProcessCommandOptions MagickWand/magick-cli.c:653
    #6 0x741800d94816 in MagickImageCommand MagickWand/magick-cli.c:1392
    #7 0x741800d913e4 in MagickCommandGenesis MagickWand/magick-cli.c:177
    #8 0x5ef7a3546638 in MagickMain utilities/magick.c:162
    #9 0x5ef7a3546872 in main utilities/magick.c:193
    #10 0x7417ff53f6b4  (/usr/lib/libc.so.6+0x276b4) (BuildId: 468e3585c794491a48ea75fceb9e4d6b1464fc35)
    #11 0x7417ff53f768 in __libc_start_main (/usr/lib/libc.so.6+0x27768) (BuildId: 468e3585c794491a48ea75fceb9e4d6b1464fc35)
    #12 0x5ef7a3546204 in _start (/home/kforfk/workspace/fuzz_analysis/saigen/ImageMagick/utilities/.libs/magick+0x2204) (BuildId: 96677b60628cf297eaedb3eb17b87000d29403f2)

0x7037f99e3ad3 is located 0 bytes after 3-byte region [0x7037f99e3ad0,0x7037f99e3ad3)
allocated by thread T0 here:
    #0 0x741801f20e15 in malloc /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:67
    #1 0x7418013e86bc in AcquireMagickMemory MagickCore/memory.c:559

SUMMARY: AddressSanitizer: heap-buffer-overflow MagickCore/image.c:1674 in InterpretImageFilename
Shadow bytes around the buggy address:
  0x7037f99e3800: fa fa 07 fa fa fa 00 fa fa fa fd fa fa fa fd fa
  0x7037f99e3880: fa fa 07 fa fa fa 00 fa fa fa fd fa fa fa fd fa
  0x7037f99e3900: fa fa 07 fa fa fa 00 fa fa fa fd fa fa fa fd fa
  0x7037f99e3980: fa fa 07 fa fa fa 00 fa fa fa fd fa fa fa fd fa
  0x7037f99e3a00: fa fa 07 fa fa fa fd fa fa fa fd fa fa fa 00 04
=>0x7037f99e3a80: fa fa 00 04 fa fa 00 00 fa fa[03]fa fa fa 03 fa
  0x7037f99e3b00: fa fa 00 01 fa fa fa fa fa fa fa fa fa fa fa fa
  0x7037f99e3b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7037f99e3c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7037f99e3c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7037f99e3d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==2227694==ABORTING

Root Cause Analysis

The first command line argument is interpreted as MagickImageCommand: https://github.com/ImageMagick/ImageMagick/blob/8fff9b4f44d2e8b5cae2bd6db70930a144d15f12/utilities/magick.c#L83

c
const CommandInfo
  MagickCommands[] =
  {
    MagickCommandSize("magick", MagickFalse, MagickImageCommand),

It is invoked here: https://github.com/ImageMagick/ImageMagick/blob/8fff9b4f44d2e8b5cae2bd6db70930a144d15f12/MagickWand/magick-cli.c#L220

c
status=command(image_info,argc,argv,&text,exception);

The execution then follows this path:

The execution eventually reaches InterpretImageFilename and enters a loop. The format variable here is "%%". At this point, it is safe to access *(format + 2) but not safe to access *(format + 3).

c
for (p=strchr(format,'%'); p != (char *) NULL; p=strchr(p+1,'%'))
{
  q=(char *) p+1;
  if (*q == '%')
    {
      p=q+1;
      continue;
    }

The first strchr call returns a pointer equal to format and assigns it to p. Then q is initialized with p + 1 (format + 1), and *q is '%', so the code enters the if branch. Here, p is reassigned to q + 1 (format + 2).

In the next iteration, p + 1 (format + 3) is passed to strchr, and when strchr accesses it, this causes an out-of-bounds read.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
.NET (NuGet) Magick.NET-Q16-AnyCPU < 14.7.0 14.7.0
.NET (NuGet) Magick.NET-Q16-arm64 < 14.7.0 14.7.0
.NET (NuGet) Magick.NET-Q16-HDRI-AnyCPU < 14.7.0 14.7.0
.NET (NuGet) Magick.NET-Q16-HDRI-arm64 < 14.7.0 14.7.0
.NET (NuGet) Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.7.0 14.7.0
.NET (NuGet) Magick.NET-Q16-HDRI-OpenMP-x64 < 14.7.0 14.7.0
.NET (NuGet) Magick.NET-Q16-HDRI-x64 < 14.7.0 14.7.0
.NET (NuGet) Magick.NET-Q16-HDRI-x86 < 14.7.0 14.7.0
.NET (NuGet) Magick.NET-Q16-OpenMP-arm64 < 14.7.0 14.7.0
.NET (NuGet) Magick.NET-Q16-OpenMP-x64 < 14.7.0 14.7.0
.NET (NuGet) Magick.NET-Q16-x64 < 14.7.0 14.7.0
.NET (NuGet) Magick.NET-Q16-x86 < 14.7.0 14.7.0
.NET (NuGet) Magick.NET-Q8-AnyCPU < 14.7.0 14.7.0
.NET (NuGet) Magick.NET-Q8-arm64 < 14.7.0 14.7.0
.NET (NuGet) Magick.NET-Q8-OpenMP-arm64 < 14.7.0 14.7.0
.NET (NuGet) Magick.NET-Q8-OpenMP-x64 < 14.7.0 14.7.0
.NET (NuGet) Magick.NET-Q8-x64 < 14.7.0 14.7.0
.NET (NuGet) Magick.NET-Q8-x86 < 14.7.0 14.7.0

References

CVSS score 3.7/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE)
CWE-125, CWE-193
Platform
.NET (NuGet)
Package
Magick.NET-Q16-AnyCPU, Magick.NET-Q16-arm64, Magick.NET-Q16-HDRI-AnyCPU
Disclosed
25.08.2025
Updated
11.10.2026 11:23

Sources and licenses

OSV / GitHub Advisory Database - GHSA-hm4x-r5hc-794f - CC BY 4.0

Vulnerability history: Magick.NET-Q16-arm64

All published vulnerabilities of this package (.NET (NuGet)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (160) in the archive
Total entries
160
First → latest
07.2025 09.2026
Without a fix
1
Exploited in attacks
0

Severity breakdown

  • High 24
  • Medium 96
  • Low 40

Disclosures per year

Severity:
  1. ImageMagick has a Heap Buffer Overflow in InterpretImageFilename this entry
    Low · 3.7 CVE-2025-53014 < 14.7.0 14.7.0
  2. ImageMagick has out-of-bounds write in ICON decoder due to incorrect loop
    High · 7.5 CVE-2026-53461 < 14.14.0 14.14.0
  3. ImageMagick: Policy Bypass can Trigger an Out-of-Memory condition
    High · 7.5 CVE-2026-53460 < 14.14.0 14.14.0
  4. ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions
    High · 7.5 CVE-2026-49218 < 14.14.0 14.14.0
  5. ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion
    High · 7.5 CVE-2026-46522 < 14.13.1 14.13.1
  6. ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions
    High · 7.5 CVE-2026-46520 < 14.13.1 14.13.1
  7. ImageMagick has a heap Buffer Overflow in ImageMagick MVG decoder
    High · 7.5 CVE-2026-33901 < 14.12.0 14.12.0
  8. ImageMagick has a Stack Overflow in DestroyXMLTree()
    High · 7.5 CVE-2026-33908 < 14.12.0 14.12.0
  9. ImageMagick has stack buffer overflow in MagnifyImage
    High · 7.7 CVE-2026-30929 < 14.10.4 14.10.4
  10. ImageMagick: Integer overflow in DIB coder can result in out of bounds read or write
    High · 8.1 CVE-2026-28693 < 14.10.4 14.10.4
  11. ImageMagick has uninitialized pointer dereference in JBIG decoder
    High · 7.5 CVE-2026-28691 < 14.10.4 14.10.4
  12. ImageMagick vulnerable to stack corruption through long morphology kernel names or arrays
    High · 7.1 CVE-2026-28494 < 14.10.4 14.10.4
  13. ImageMagick: MSL attribute stack buffer overflow leads to out of bounds write.
    High · 7.4 CVE-2026-25968 < 14.10.3 14.10.3
  14. ImageMagick: Integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder
    High · 7.5 CVE-2026-25989 < 14.10.3 14.10.3
  15. ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder
    High · 7.5 CVE-2026-25985 < 14.10.3 14.10.3
  16. ImageMagick: Stack buffer overflow in FTXT reader via oversized integer field
    High · 7.4 CVE-2026-25967 < 14.10.3 14.10.3
  17. ImageMagick: Policy bypass through path traversal allows reading restricted content despite secured policy
    High · 8.6 CVE-2026-25965 < 14.10.3 14.10.3
  18. ImageMagick has heap-buffer-overflow via signed integer overflow in WriteUHDRImage when writing UHDR images with large dimensions
    High · 8.2 CVE-2026-25794 < 14.10.3 14.10.3
  19. ImageMagick: Infinite loop vulnerability when parsing a PCD file
    High · 7.5 CVE-2026-24485 < 14.10.3 14.10.3
  20. ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression
    High · 7.5 CVE-2026-24481 < 14.10.3 14.10.3
  21. ImageMagick has a Format String Bug in InterpretImageFilename leads to arbitrary code execution
    High · 7.5 CVE-2025-55298 < 14.8.1 14.8.1
Show more (4) Showing 21 of 25

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.