Search for vulnerabilities
Vulnerability details: VCID-xspy-9x25-xqaq
Vulnerability ID VCID-xspy-9x25-xqaq
Aliases CVE-2025-53014
GHSA-hm4x-r5hc-794f
Summary ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue.
Status Published
Exploitability 0.5
Weighted Severity 3.3
Risk 1.6
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-125 Out-of-bounds Read
CWE-193 Off-by-one Error
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 3.7 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53014.json
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00059 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00059 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.0006 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.0006 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.0006 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.0006 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00061 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00061 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00061 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
epss 0.00061 https://api.first.org/data/v1/epss?cve=CVE-2025-53014
cvssv3.1 4.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr LOW https://github.com/advisories/GHSA-hm4x-r5hc-794f
cvssv3.1 3.7 https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0
generic_textual LOW https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0
cvssv3.1 3.7 https://github.com/ImageMagick/ImageMagick
generic_textual LOW https://github.com/ImageMagick/ImageMagick
cvssv3.1 3.7 https://github.com/ImageMagick/ImageMagick6/commit/79b6ed03770781d996d1710b89fbb887e5ea758a
generic_textual LOW https://github.com/ImageMagick/ImageMagick6/commit/79b6ed03770781d996d1710b89fbb887e5ea758a
cvssv3.1 3.7 https://github.com/ImageMagick/ImageMagick/commit/29d82726c7ec20c07c49ba263bdcea16c2618e03
generic_textual LOW https://github.com/ImageMagick/ImageMagick/commit/29d82726c7ec20c07c49ba263bdcea16c2618e03
cvssv3.1 3.7 https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f
cvssv3.1_qr LOW https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f
generic_textual LOW https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f
ssvc Track https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f
cvssv3.1 3.7 https://nvd.nist.gov/vuln/detail/CVE-2025-53014
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2025-53014
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53014.json
https://api.first.org/data/v1/epss?cve=CVE-2025-53014
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53014
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0
https://github.com/ImageMagick/ImageMagick
https://github.com/ImageMagick/ImageMagick6/commit/79b6ed03770781d996d1710b89fbb887e5ea758a
https://github.com/ImageMagick/ImageMagick/commit/29d82726c7ec20c07c49ba263bdcea16c2618e03
1109339 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109339
2379941 https://bugzilla.redhat.com/show_bug.cgi?id=2379941
CVE-2025-53014 https://nvd.nist.gov/vuln/detail/CVE-2025-53014
GHSA-hm4x-r5hc-794f https://github.com/advisories/GHSA-hm4x-r5hc-794f
GHSA-hm4x-r5hc-794f https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f
USN-7728-1 https://usn.ubuntu.com/7728-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53014.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/ImageMagick/ImageMagick
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/ImageMagick/ImageMagick6/commit/79b6ed03770781d996d1710b89fbb887e5ea758a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/ImageMagick/ImageMagick/commit/29d82726c7ec20c07c49ba263bdcea16c2618e03
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-07-14T18:26:03Z/ Found at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-53014
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.0897
EPSS Score 0.00036
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T09:22:08.272947+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/53xxx/CVE-2025-53014.json 37.0.0