Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/49335?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/49335?format=api", "vulnerability_id": "VCID-kymx-rjrd-m3g4", "summary": "Withdrawn Advisory: ImageMagick has a use-after-free/double-free risk in Options::fontFamily when clearing family\n## Withdrawn Advisory\nThis advisory has been withdrawn because it does not affect the ImageMagick project's NuGet packages.\n\n### Original Description\nWe believe that we have discovered a potential security vulnerability in ImageMagick’s Magick++ layer that manifests when `Options::fontFamily` is invoked with an empty string.\n\n**Vulnerability Details**\n- Clearing a font family calls `RelinquishMagickMemory` on `_drawInfo->font`, freeing the font string but leaving `_drawInfo->font` pointing to freed memory while `_drawInfo->family` is set to that (now-invalid) pointer. Any later cleanup or reuse of `_drawInfo->font` re-frees or dereferences dangling memory.\n- `DestroyDrawInfo` and other setters (`Options::font`, `Image::font`) assume `_drawInfo->font` remains valid, so destruction or subsequent updates trigger crashes or heap corruption.\n\n```cpp\nif (family_.length() == 0)\n {\n _drawInfo->family=(char *) RelinquishMagickMemory(_drawInfo->font);\n DestroyString(RemoveImageOption(imageInfo(),\"family\"));\n }\n```\n\n- **CWE-416 (Use After Free):** `_drawInfo->font` is left dangling yet still reachable through the Options object.\n- **CWE-415 (Double Free):** DrawInfo teardown frees `_drawInfo->font` again, provoking allocator aborts.\n\n**Affected Versions**\n- Introduced by commit `6409f34d637a34a1c643632aa849371ec8b3b5a8` (“Added fontFamily to the Image class of Magick++”, 2015-08-01, blame line 313).\n- Present in all releases that include that commit, at least ImageMagick 7.0.1-0 and later (likely late 6.9 builds with Magick++ font family support as well). Older releases without `fontFamily` are unaffected.\n\n**Command Line Triggerability**\nThis vulnerability cannot be triggered from the command line interface. The bug is specific to the Magick++ C++ API, specifically the `Options::fontFamily()` method. The command-line utilities (such as `convert`, `magick`, etc.) do not expose this particular code path, as they operate through different internal mechanisms that do not directly call `Options::fontFamily()` with an empty string in a way that would trigger the use-after-free condition.\n\n**Proposed Fix**\n```diff\ndiff --git a/Magick++/lib/Options.cpp b/Magick++/lib/Options.cpp\n@@ void Magick::Options::fontFamily(const std::string &family_)\n- _drawInfo->family=(char *) RelinquishMagickMemory(_drawInfo->font);\n+ _drawInfo->family=(char *) RelinquishMagickMemory(_drawInfo->family);\n```\nThis frees only the actual family string, leaving `_drawInfo->font` untouched. Optionally nulling `_drawInfo->font` when clearing `font()` itself maintains allocator hygiene.", "aliases": [ { "alias": "CVE-2025-65955" }, { "alias": "GHSA-q3hc-j9x5-mp9m" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/99005?format=api", "purl": "pkg:deb/debian/imagemagick@8:6.9.11.60%2Bdfsg-1.3%2Bdeb11u4?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hr11-5edt-5ugu" }, { "vulnerability": "VCID-z5ve-fkb6-8yhs" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/imagemagick@8:6.9.11.60%252Bdfsg-1.3%252Bdeb11u4%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/99315?format=api", "purl": "pkg:deb/debian/imagemagick@8:6.9.11.60%2Bdfsg-1.3%2Bdeb11u8?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/imagemagick@8:6.9.11.60%252Bdfsg-1.3%252Bdeb11u8%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/99309?format=api", "purl": "pkg:deb/debian/imagemagick@8:6.9.11.60%2Bdfsg-1.6%2Bdeb12u5?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/imagemagick@8:6.9.11.60%252Bdfsg-1.6%252Bdeb12u5%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/99003?format=api", "purl": "pkg:deb/debian/imagemagick@8:6.9.11.60%2Bdfsg-1.6%2Bdeb12u9?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-z5ve-fkb6-8yhs" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/imagemagick@8:6.9.11.60%252Bdfsg-1.6%252Bdeb12u9%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/99314?format=api", "purl": "pkg:deb/debian/imagemagick@8:7.1.1.43%2Bdfsg1-1%2Bdeb13u4?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/imagemagick@8:7.1.1.43%252Bdfsg1-1%252Bdeb13u4%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/99008?format=api", "purl": "pkg:deb/debian/imagemagick@8:7.1.1.43%2Bdfsg1-1%2Bdeb13u8?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-z5ve-fkb6-8yhs" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/imagemagick@8:7.1.1.43%252Bdfsg1-1%252Bdeb13u8%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/99316?format=api", "purl": "pkg:deb/debian/imagemagick@8:7.1.2.12%2Bdfsg1-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/imagemagick@8:7.1.2.12%252Bdfsg1-1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/99006?format=api", "purl": "pkg:deb/debian/imagemagick@8:7.1.2.23%2Bdfsg1-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/imagemagick@8:7.1.2.23%252Bdfsg1-1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/99007?format=api", "purl": "pkg:deb/debian/imagemagick@8:7.1.2.24%2Bdfsg1-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/imagemagick@8:7.1.2.24%252Bdfsg1-1%3Fdistro=trixie" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/72796?format=api", "purl": "pkg:nuget/magick.net-q16-anycpu@14.9.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-kymx-rjrd-m3g4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q16-anycpu@14.9.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/72730?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.9.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-kymx-rjrd-m3g4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.9.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/72759?format=api", "purl": "pkg:nuget/magick.net-q16-hdri-anycpu@14.9.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-kymx-rjrd-m3g4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q16-hdri-anycpu@14.9.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/72798?format=api", "purl": "pkg:nuget/Magick.NET-Q16-HDRI-arm64@14.9.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-kymx-rjrd-m3g4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-arm64@14.9.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/72755?format=api", "purl": "pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-arm64@14.9.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-kymx-rjrd-m3g4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-arm64@14.9.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/72754?format=api", "purl": "pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.9.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-kymx-rjrd-m3g4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.9.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/72756?format=api", "purl": "pkg:nuget/Magick.NET-Q16-HDRI-x64@14.9.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-kymx-rjrd-m3g4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-x64@14.9.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/72788?format=api", "purl": "pkg:nuget/Magick.NET-Q16-HDRI-x86@14.9.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-kymx-rjrd-m3g4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-x86@14.9.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/72790?format=api", "purl": "pkg:nuget/Magick.NET-Q16-OpenMP-arm64@14.9.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-kymx-rjrd-m3g4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-OpenMP-arm64@14.9.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/72789?format=api", "purl": "pkg:nuget/Magick.NET-Q16-OpenMP-x64@14.9.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-kymx-rjrd-m3g4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-OpenMP-x64@14.9.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/72729?format=api", "purl": "pkg:nuget/magick.net-q16-x64@14.9.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-kymx-rjrd-m3g4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q16-x64@14.9.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/72752?format=api", "purl": "pkg:nuget/Magick.NET-Q16-x86@14.9.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-kymx-rjrd-m3g4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-x86@14.9.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/72758?format=api", "purl": "pkg:nuget/magick.net-q8-anycpu@14.9.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-kymx-rjrd-m3g4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-anycpu@14.9.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/72728?format=api", "purl": "pkg:nuget/Magick.NET-Q8-arm64@14.9.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-kymx-rjrd-m3g4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q8-arm64@14.9.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/72787?format=api", "purl": "pkg:nuget/Magick.NET-Q8-OpenMP-arm64@14.9.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-kymx-rjrd-m3g4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q8-OpenMP-arm64@14.9.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/72731?format=api", "purl": "pkg:nuget/magick.net-q8-openmp-x64@14.9.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-kymx-rjrd-m3g4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.9.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/72797?format=api", "purl": "pkg:nuget/magick.net-q8-x64@14.9.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-kymx-rjrd-m3g4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-x64@14.9.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/72764?format=api", "purl": "pkg:nuget/Magick.NET-Q8-x86@14.9.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-kymx-rjrd-m3g4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q8-x86@14.9.1" } ], "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-65955.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-65955.json" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/6409f34d637a34a1c643632aa849371ec8b3b5a8", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/6409f34d637a34a1c643632aa849371ec8b3b5a8" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/6f81eb15f822ad86e8255be75efad6f9762c32f8", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/6f81eb15f822ad86e8255be75efad6f9762c32f8" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1122827", "reference_id": "1122827", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1122827" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418549", "reference_id": "2418549", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418549" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65955", "reference_id": "CVE-2025-65955", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65955" }, { "reference_url": "https://github.com/advisories/GHSA-q3hc-j9x5-mp9m", "reference_id": "GHSA-q3hc-j9x5-mp9m", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-q3hc-j9x5-mp9m" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q3hc-j9x5-mp9m", "reference_id": "GHSA-q3hc-j9x5-mp9m", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q3hc-j9x5-mp9m" } ], "weaknesses": [ { "cwe_id": 415, "name": "Double Free", "description": "The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." }, { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." }, { "cwe_id": 825, "name": "Expired Pointer Dereference", "description": "The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid." } ], "exploits": [], "severity_range_score": "4.0 - 6.9", "exploitability": "0.5", "weighted_severity": "6.2", "risk_score": 3.1, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-kymx-rjrd-m3g4" }