3.8 CVE-2025-57807

Patch Exploit

ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functions: SeekBlob(), which permits advancing the stream offset beyond the current end without increasing capacity, and WriteBlob(), which then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset â« extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 2â¶â´ arithmetic wrap, external delegates, or policy settings are required. This is fixed in version 14.8.2.
https://nvd.nist.gov/vuln/detail/CVE-2025-57807

Categories

CWE-122 : Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues. Pre-design: Use a language or compiler that performs automatic bounds checking. Use an abstraction library to abstract away risky APIs. Not a complete solution. Implement and perform bounds checking on input. Do not use dangerous functions such as gets. Look for their safe equivalent, which checks for the boundary. Use OS-level preventative functionality. This is not a complete solution, but it provides some defense in depth. Chain: in a web browser, an unsigned 64-bit integer is forcibly cast to a 32-bit integer (CWE-681) and potentially leading to an integer overflow (CWE-190). If an integer overflow occurs, this can cause heap memory corruption (CWE-122) Chain: integer signedness error (CWE-195) passes signed comparison, leading to heap overflow (CWE-122) Chain: product does not handle when an input string is not NULL terminated (CWE-170), leading to buffer over-read (CWE-125) or heap-based buffer overflow (CWE-122). Chain: machine-learning product can have a heap-basedbuffer overflow (CWE-122) when some integer-oriented bounds arecalculated by using ceiling() and floor() on floating point values(CWE-1339) Chain: integer overflow (CWE-190) causes a negative signed value, which later bypasses a maximum-only check (CWE-839), leading to heap-based buffer overflow (CWE-122).

References

134c704f-9b21-4f2e-91b3-4a467353bcc0 Exploit

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6... Exploit Mitigation Vendor Advisory

security-advisories@github.com Patch Exploit

https://github.com/ImageMagick/ImageMagick/commit/077a417a19a5ea8c85559b60275... Patch
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6... Exploit Mitigation Vendor Advisory

CPE

cpe	start	end
Configuration 1
cpe:2.3:a:imagemagick:imagemagick::::::::		< 6.9.13-29
cpe:2.3:a:imagemagick:imagemagick::::::::	>= 7.0.0-0	< 7.1.2-3

REMEDIATION

Patch

Url
https://github.com/ImageMagick/ImageMagick/commit/077a417a19a5ea8c85559b60275...

EXPLOITS

Exploit-db.com

id	description	date
No known exploits

POC Github

Url
No known exploits

Other Nist (github, ...)

Url
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6...
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6...

CAPEC

Common Attack Pattern Enumerations and Classifications

id	description	severity
92	Forced Integer Overflow This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code. The first step is exploratory meaning the attacker looks for an integer variable that they can control. The attacker finds an integer variable that they can write into or manipulate and try to get the value of the integer out of the possible range. The integer variable is forced to have a value out of range which set its final value to an unexpected value. The target host acts on the data and unexpected behavior may happen.	High

Cybersecurity needs ?

Strengthen software security from the outset with our DevSecOps expertise

Integrate security right from the start of the software development cycle for more robust applications and greater customer confidence.
Our team of DevSecOps experts can help you secure your APIs, data pipelines, CI/CD chains, Docker containers and Kubernetes deployments.

Discover this offer

Soutenez No Hack Me sur Tipeee