Search for vulnerabilities
Vulnerability details: VCID-hqmn-6g6z-bqak
Vulnerability ID VCID-hqmn-6g6z-bqak
Aliases CVE-2025-57807
GHSA-23hg-53q6-hqfg
Summary ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functions: SeekBlob(), which permits advancing the stream offset beyond the current end without increasing capacity, and WriteBlob(), which then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset ≫ extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 2⁶⁴ arithmetic wrap, external delegates, or policy settings are required. This is fixed in version 14.8.2.
Status Published
Exploitability 0.5
Weighted Severity 3.8
Risk 1.9
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-122 Heap-based Buffer Overflow
CWE-131 Incorrect Calculation of Buffer Size
CWE-787 Out-of-bounds Write
System Score Found at
cvssv3 4.2 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-57807.json
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2025-57807
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-57807
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-57807
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-57807
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2025-57807
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2025-57807
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2025-57807
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2025-57807
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2025-57807
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2025-57807
cvssv3.1 4.2 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr LOW https://github.com/advisories/GHSA-23hg-53q6-hqfg
cvssv3.1 3.8 https://github.com/ImageMagick/ImageMagick
generic_textual LOW https://github.com/ImageMagick/ImageMagick
cvssv3.1 3.8 https://github.com/ImageMagick/ImageMagick/commit/077a417a19a5ea8c85559b602754a5b928eef23e
generic_textual LOW https://github.com/ImageMagick/ImageMagick/commit/077a417a19a5ea8c85559b602754a5b928eef23e
ssvc Track https://github.com/ImageMagick/ImageMagick/commit/077a417a19a5ea8c85559b602754a5b928eef23e
cvssv3.1 3.8 https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6-hqfg
cvssv3.1_qr LOW https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6-hqfg
generic_textual LOW https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6-hqfg
ssvc Track https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6-hqfg
cvssv3.1 3.8 https://nvd.nist.gov/vuln/detail/CVE-2025-57807
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2025-57807
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-57807.json
https://api.first.org/data/v1/epss?cve=CVE-2025-57807
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-57807
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/ImageMagick/ImageMagick
https://nvd.nist.gov/vuln/detail/CVE-2025-57807
077a417a19a5ea8c85559b602754a5b928eef23e https://github.com/ImageMagick/ImageMagick/commit/077a417a19a5ea8c85559b602754a5b928eef23e
1114520 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1114520
2393590 https://bugzilla.redhat.com/show_bug.cgi?id=2393590
GHSA-23hg-53q6-hqfg https://github.com/advisories/GHSA-23hg-53q6-hqfg
GHSA-23hg-53q6-hqfg https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6-hqfg
USN-7756-1 https://usn.ubuntu.com/7756-1/
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-57807.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L Found at https://github.com/ImageMagick/ImageMagick
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L Found at https://github.com/ImageMagick/ImageMagick/commit/077a417a19a5ea8c85559b602754a5b928eef23e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-08T13:58:41Z/ Found at https://github.com/ImageMagick/ImageMagick/commit/077a417a19a5ea8c85559b602754a5b928eef23e
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L Found at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6-hqfg
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-08T13:58:41Z/ Found at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6-hqfg
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2025-57807
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.01115
EPSS Score 0.00012
Published At Sept. 9, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-09-09T16:38:00.038319+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/57xxx/CVE-2025-57807.json 37.0.0