CVE-2025-57807 ImageMagick BlobStream Forward-Seek Under-Allocation

What is CVE-2025-57807?

CVE-2025-57807 is a low-severity memory corruption vulnerability in Imagemagick Imagemagick, published on 5 Sep 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functions: SeekBlob(), which permits advancing the stream offset beyond the current end without increasing capacity, and WriteBlob(), which then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset ≫ extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 2⁶⁴ arithmetic wrap, external delegates, or policy settings are required. This is fixed in version 14.8.2.

Weakness: CWE-787, CWE-131, CWE-122

Which versions are affected by CVE-2025-57807?

24 open source packages ship an affected version, including Magick.NET-Q16-HDRI-OpenMP-arm64, Magick.NET-Q16-HDRI-OpenMP-x64 and Magick.NET-Q16-HDRI-arm64. It affects 1 product.

Products include Imagemagick Imagemagick.

How do I fix CVE-2025-57807?

Upgrade Magick.NET-Q16-HDRI-OpenMP-arm64 to 14.8.2 or later.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2025-57807 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-57807 exists.

Other vulnerabilities in Imagemagick Imagemagick

• CVE-2019-19952 Use after free in n/a Critical 9.8
• CVE-2018-16328 Null dereference in n/a Critical 9.8
• CVE-2018-16329 Null dereference in n/a Critical 9.8
• CVE-2017-18210 Null dereference in n/a Critical 9.8
• CVE-2017-14138 Denial of service in n/a Critical 9.8

All Imagemagick Imagemagick vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLSA-2025-1758635329, CLSA-2025-1758704282, CLSA-2025-1758705954, CLSA-2026-1775682890, CLSA-2026-1775683048, CLSA-2026-1775683193 and 14 more.