CVE-2025-57803 ImageMagick (WriteBMPImage): 32-bit integer overflow when writing BMP scanline stride → heap buffer overflow
A 32-bit integer overflow in ImageMagick's BMP encoder causes a heap buffer overflow, allowing attackers to execute arbitrary code via crafted images.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-57803?
CVE-2025-57803 is a high-severity vulnerability in Imagemagick Imagemagick, published on 26 Aug 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.
Which versions are affected by CVE-2025-57803?
12 open source packages ship an affected version, including Magick.NET-Q16-AnyCPU, Magick.NET-Q16-HDRI-AnyCPU and Magick.NET-Q16-HDRI-x86. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Magick.NET-Q16-AnyCPU NuGet | All versions | 14.8.1 |
Magick.NET-Q16-AnyCPU NuGet | All versions | 14.8.1 |
Magick.NET-Q16-HDRI-AnyCPU NuGet | All versions | 14.8.1 |
Magick.NET-Q16-HDRI-AnyCPU NuGet | All versions | 14.8.1 |
Magick.NET-Q16-HDRI-x86 NuGet | All versions | 14.8.1 |
Magick.NET-Q16-HDRI-x86 NuGet | All versions | 14.8.1 |
6 more packages
Magick.NET-Q16-x86 NuGet | All versions | 14.8.1 |
Magick.NET-Q16-x86 NuGet | All versions | 14.8.1 |
Magick.NET-Q8-AnyCPU NuGet | All versions | 14.8.1 |
Magick.NET-Q8-AnyCPU NuGet | All versions | 14.8.1 |
Magick.NET-Q8-x86 NuGet | All versions | 14.8.1 |
Magick.NET-Q8-x86 NuGet | All versions | 14.8.1 |
Linux distribution packages (7)
ImageMagick Red Hat:rhel_els:7 | All versions | 0:6.9.10.68-9.el7_9 |
ImageMagick-c++ Red Hat:rhel_els:7 | All versions | 0:6.9.10.68-9.el7_9 |
ImageMagick-c++-devel Red Hat:rhel_els:7 | All versions | 0:6.9.10.68-9.el7_9 |
ImageMagick-debuginfo Red Hat:rhel_els:7 | All versions | 0:6.9.10.68-9.el7_9 |
ImageMagick-devel Red Hat:rhel_els:7 | All versions | 0:6.9.10.68-9.el7_9 |
ImageMagick-doc Red Hat:rhel_els:7 | All versions | 0:6.9.10.68-9.el7_9 |
ImageMagick-perl Red Hat:rhel_els:7 | All versions | 0:6.9.10.68-9.el7_9 |
Products include Imagemagick Imagemagick.
How do I fix CVE-2025-57803?
Upgrade Magick.NET-Q16-AnyCPU to 14.8.1 or later.
Is CVE-2025-57803 being exploited?
There is no known exploitation of CVE-2025-57803 in the wild and no public exploit code.
Other vulnerabilities in Imagemagick Imagemagick
Sources
Also known as CLSA-2025-1759856402, CLSA-2025-1760019012, CLSA-2025-1760023801, CLSA-2026-1776170814, CLSA-2026-1776171379, CLSA-2026-1776171616 and 6 more.