CVE-2025-55298
📋 TL;DR
A format string vulnerability in ImageMagick's InterpretImageFilename function allows attackers to overwrite arbitrary memory regions by passing unsanitized user input to FormatLocaleString. This can lead to heap overflow or remote code execution. All systems running vulnerable ImageMagick versions are affected.
💻 Affected Systems
- ImageMagick
- Magick.NET
- Any software using vulnerable ImageMagick libraries
📦 What is this software?
Imagemagick by Imagemagick
Imagemagick by Imagemagick
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the ImageMagick process, potentially leading to full system compromise.
Likely Case
Denial of service through application crashes or limited memory corruption leading to data leakage.
If Mitigated
Minimal impact if proper input validation and sandboxing are implemented.
🎯 Exploit Status
Exploitation requires crafting malicious image filenames or metadata that trigger the format string bug.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ImageMagick 6.9.13-28 and 7.1.2-2
Vendor Advisory: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645
Restart Required: Yes
Instructions:
1. Update ImageMagick to version 6.9.13-28 or 7.1.2-2 using your package manager. 2. Restart any services using ImageMagick. 3. For Magick.NET, update to version 14.8.1 or later.
🔧 Temporary Workarounds
Disable vulnerable image formats
allRemove or disable ImageMagick's ability to process untrusted image formats via policy.xml
Edit /etc/ImageMagick-6/policy.xml or /etc/ImageMagick-7/policy.xml
Add <policy domain="coder" rights="none" pattern="*" /> to block all formats
Sandbox ImageMagick processes
linuxRun ImageMagick in a container or with reduced privileges
docker run --security-opt no-new-privileges imagename
Use seccomp or AppArmor profiles
🧯 If You Can't Patch
- Implement strict input validation to reject malformed filenames before passing to ImageMagick.
- Isolate ImageMagick processing to dedicated, non-privileged systems with network restrictions.
🔍 How to Verify
Check if Vulnerable:
Run 'convert --version' or 'magick --version' and check if version is below 6.9.13-28 or 7.1.2-2.Check Version:
convert --version 2>/dev/null || magick --version 2>/dev/nullVerify Fix Applied:
Confirm version is 6.9.13-28 or higher for ImageMagick 6, or 7.1.2-2 or higher for ImageMagick 7.📡 Detection & Monitoring
Log Indicators:
- ImageMagick process crashes with segmentation faults
- Unusual filename patterns in image processing logs
Network Indicators:
- Unexpected outbound connections from image processing servers
SIEM Query:
process_name:"convert" OR process_name:"magick" AND (event_type:crash OR command_line:*%*%*)🔗 References
- https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645
- https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1
- https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645
