CVE-2025-55004
📋 TL;DR
ImageMagick versions before 7.1.2-1 contain a heap-buffer overflow vulnerability in the MNG image format parser that can leak memory contents into output images. This affects any system or application that processes untrusted MNG images with ImageMagick. The vulnerability allows information disclosure but not arbitrary code execution.
💻 Affected Systems
- ImageMagick
📦 What is this software?
Imagemagick by Imagemagick
⚠️ Risk & Real-World Impact
Worst Case
Attackers could extract sensitive data from memory (passwords, keys, other process data) by crafting malicious MNG images and observing the output.
Likely Case
Information disclosure where attackers can leak some memory contents from the ImageMagick process into manipulated output images.
If Mitigated
Minimal impact with proper input validation and sandboxing, though some information leakage might still occur.
🎯 Exploit Status
Exploitation requires crafting specific MNG images with separate alpha channels and triggering magnification operations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.1.2-1
Vendor Advisory: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cjc8-g9w8-chfw
Restart Required: No
Instructions:
1. Update ImageMagick to version 7.1.2-1 or later. 2. For Linux: Use package manager (apt-get update && apt-get install imagemagick). 3. For source builds: Download latest from imagemagick.org and recompile.
🔧 Temporary Workarounds
Disable MNG format processing
linuxRemove or disable MNG format support in ImageMagick policy.xml
Edit /etc/ImageMagick-7/policy.xml or similar and add: <policy domain="delegate" rights="none" pattern="MNG" />
Sandbox ImageMagick processing
linuxRun ImageMagick in isolated containers with minimal privileges
docker run --read-only --cap-drop=ALL -v /tmp:/tmp:ro imagename convert input.mng output.jpg
🧯 If You Can't Patch
- Implement strict input validation to reject or sanitize MNG images before processing
- Deploy web application firewalls with image format filtering rules
🔍 How to Verify
Check if Vulnerable:
Check ImageMagick version: convert --version | head -1Check Version:
convert --version | head -1Verify Fix Applied:
Verify version is 7.1.2-1 or higher: convert --version | grep -q '7.1.2-1' && echo 'Patched'📡 Detection & Monitoring
Log Indicators:
- Multiple failed MNG image processing attempts
- Unusual memory usage patterns in ImageMagick processes
Network Indicators:
- Unexpected MNG image uploads to image processing endpoints
SIEM Query:
source="web_logs" AND uri_path="/upload" AND file_extension="mng"