{"answers":{"affected":"24 open source packages ship an affected version, including Magick.NET-Q16-HDRI-OpenMP-arm64, Magick.NET-Q16-HDRI-OpenMP-x64 and Magick.NET-Q16-HDRI-arm64. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-57807 exists.","fix":"Upgrade Magick.NET-Q16-HDRI-OpenMP-arm64 to 14.8.2 or later.","what":"CVE-2025-57807 is a low-severity memory corruption vulnerability in Imagemagick Imagemagick, published on 5 Sep 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2025-57807 and fix it if it is affected.\n\nWhat it is: CVE-2025-57807 is a low-severity memory corruption vulnerability in Imagemagick Imagemagick, published on 5 Sep 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-57807 exists.\n\nAffected packages and fixed versions:\n- Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet): affected all versions; fixed in 14.8.2\n- Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet): affected all versions; fixed in 14.8.2\n- Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet): affected all versions; fixed in 14.8.2\n- Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet): affected all versions; fixed in 14.8.2\n- Magick.NET-Q16-HDRI-arm64 (NuGet): affected all versions; fixed in 14.8.2\n- Magick.NET-Q16-HDRI-arm64 (NuGet): affected all versions; fixed in 14.8.2\n- Magick.NET-Q16-HDRI-x64 (NuGet): affected all versions; fixed in 14.8.2\n- Magick.NET-Q16-HDRI-x64 (NuGet): affected all versions; fixed in 14.8.2\n- Magick.NET-Q16-OpenMP-arm64 (NuGet): affected all versions; fixed in 14.8.2\n- Magick.NET-Q16-OpenMP-arm64 (NuGet): affected all versions; fixed in 14.8.2\n- Magick.NET-Q16-OpenMP-x64 (NuGet): affected all versions; fixed in 14.8.2\n- Magick.NET-Q16-OpenMP-x64 (NuGet): affected all versions; fixed in 14.8.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-57807/ (Markdown: https://insights.sbomify.com/CVE-2025-57807/index.md)","id":"CVE-2025-57807","markdown":"https://insights.sbomify.com/CVE-2025-57807/index.md","name":"CVE-2025-57807","record":{"aliases":["CLSA-2025-1758635329","CLSA-2025-1758704282","CLSA-2025-1758705954","CLSA-2026-1775682890","CLSA-2026-1775683048","CLSA-2026-1775683193","DEBIAN-CVE-2025-57807","GHSA-23hg-53q6-hqfg","JLSEC-2026-926","MINI-jfhj-78pr-6f5j","OESA-2025-2244","OESA-2025-2245","OESA-2025-2246","OESA-2025-2248","OESA-2025-2249","SUSE-SU-2025:03509-1","SUSE-SU-2025:03510-1","SUSE-SU-2025:03616-1","UBUNTU-CVE-2025-57807","openSUSE-SU-2025:15543-1"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"ImageMagick library","requires_auth":"high_privilege","summary":"A heap buffer overflow in ImageMagick allows attackers to execute arbitrary code via crafted image files due to incorrect memory allocation during stream seeking.","user_interaction":"required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"imagemagick","vendor":"imagemagick"}],"cvss":{"score":3.8,"severity":"low","source":"cna","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"},{"id":"CWE-131","name":"Incorrect Calculation of Buffer Size"},{"id":"CWE-122","name":"Heap-based Buffer Overflow"}],"description":"ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include  insecure functions: SeekBlob(), which permits advancing the stream offset beyond the current end without increasing capacity, and WriteBlob(), which then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset ≫ extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 2⁶⁴ arithmetic wrap, external delegates, or policy settings are required. This is fixed in version 14.8.2.","ecosystems":["NuGet","SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","SUSE:Linux Enterprise Module for Development Tools 15 SP6","SUSE:Linux Enterprise Module for Development Tools 15 SP7","openSUSE:Leap 15.6","openSUSE:Tumbleweed"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"ImageMagick BlobStream Forward-Seek Under-Allocation","id":"CVE-2025-57807","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"NuGet","product":"imagemagick:imagemagick","products":["imagemagick:imagemagick"],"type":"memory_corruption","year":"2025"},"n_packages":32,"n_references":2,"next":{"headline":"ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header","id":"CVE-2025-57808"},"packages":[{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q16-HDRI-OpenMP-arm64","purl":null,"source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q16-HDRI-OpenMP-arm64","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-arm64","source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q16-HDRI-OpenMP-x64","purl":null,"source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q16-HDRI-OpenMP-x64","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64","source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q16-HDRI-arm64","purl":null,"source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q16-HDRI-arm64","purl":"pkg:nuget/Magick.NET-Q16-HDRI-arm64","source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q16-HDRI-x64","purl":null,"source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q16-HDRI-x64","purl":"pkg:nuget/Magick.NET-Q16-HDRI-x64","source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q16-OpenMP-arm64","purl":null,"source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q16-OpenMP-arm64","purl":"pkg:nuget/Magick.NET-Q16-OpenMP-arm64","source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q16-OpenMP-x64","purl":null,"source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q16-OpenMP-x64","purl":"pkg:nuget/Magick.NET-Q16-OpenMP-x64","source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q16-arm64","purl":null,"source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q16-arm64","purl":"pkg:nuget/Magick.NET-Q16-arm64","source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q16-x64","purl":null,"source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q16-x64","purl":"pkg:nuget/Magick.NET-Q16-x64","source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q8-OpenMP-arm64","purl":null,"source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q8-OpenMP-arm64","purl":"pkg:nuget/Magick.NET-Q8-OpenMP-arm64","source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q8-OpenMP-x64","purl":null,"source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q8-OpenMP-x64","purl":"pkg:nuget/Magick.NET-Q8-OpenMP-x64","source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q8-arm64","purl":null,"source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q8-arm64","purl":"pkg:nuget/Magick.NET-Q8-arm64","source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q8-x64","purl":null,"source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"NuGet","fixed":["14.8.2"],"introduced":["0"],"last_affected":[],"package":"Magick.NET-Q8-x64","purl":"pkg:nuget/Magick.NET-Q8-x64","source":"GHSA-23hg-53q6-hqfg"},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","fixed":["7.1.0.9-150400.6.43.1"],"introduced":["0"],"last_affected":[],"package":"ImageMagick","purl":"pkg:rpm/suse/ImageMagick\u0026distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP6","source":"SUSE-SU-2025:03616-1"},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","fixed":["7.1.1.21-150600.3.23.1"],"introduced":["0"],"last_affected":[],"package":"ImageMagick","purl":"pkg:rpm/suse/ImageMagick\u0026distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP6","source":"SUSE-SU-2025:03509-1"},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","fixed":["7.1.0.9-150400.6.43.1"],"introduced":["0"],"last_affected":[],"package":"ImageMagick","purl":"pkg:rpm/suse/ImageMagick\u0026distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7","source":"SUSE-SU-2025:03616-1"},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","fixed":["7.1.1.43-150700.3.16.1"],"introduced":["0"],"last_affected":[],"package":"ImageMagick","purl":"pkg:rpm/suse/ImageMagick\u0026distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7","source":"SUSE-SU-2025:03510-1"},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","fixed":["7.1.1.21-150600.3.23.1"],"introduced":["0"],"last_affected":[],"package":"ImageMagick","purl":"pkg:rpm/suse/ImageMagick\u0026distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP6","source":"SUSE-SU-2025:03509-1"},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","fixed":["7.1.1.43-150700.3.16.1"],"introduced":["0"],"last_affected":[],"package":"ImageMagick","purl":"pkg:rpm/suse/ImageMagick\u0026distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP7","source":"SUSE-SU-2025:03510-1"},{"ecosystem":"openSUSE:Leap 15.6","fixed":["7.1.1.21-150600.3.23.1"],"introduced":["0"],"last_affected":[],"package":"ImageMagick","purl":"pkg:rpm/opensuse/ImageMagick\u0026distro=openSUSE%20Leap%2015.6","source":"SUSE-SU-2025:03509-1"},{"ecosystem":"openSUSE:Tumbleweed","fixed":["7.1.2.3-1.1"],"introduced":["0"],"last_affected":[],"package":"ImageMagick","purl":"pkg:rpm/opensuse/ImageMagick\u0026distro=openSUSE%20Tumbleweed","source":"openSUSE-SU-2025:15543-1"}],"prev":{"headline":"Local Deep Research's API keys are stored in plain text","id":"CVE-2025-57806"},"products":["ImageMagick"],"published":"2025-09-05","related":[{"cvss_score":9.8,"headline":"Use after free in n/a","id":"CVE-2019-19952","kev_date_added":null,"published":"2019-12-24"},{"cvss_score":9.8,"headline":"Null dereference in n/a","id":"CVE-2018-16328","kev_date_added":null,"published":"2018-09-01"},{"cvss_score":9.8,"headline":"Null dereference in n/a","id":"CVE-2018-16329","kev_date_added":null,"published":"2018-09-01"},{"cvss_score":9.8,"headline":"Null dereference in n/a","id":"CVE-2017-18210","kev_date_added":null,"published":"2018-03-01"},{"cvss_score":9.8,"headline":"Denial of service in n/a","id":"CVE-2017-14138","kev_date_added":null,"published":"2017-09-04"},{"cvss_score":9.8,"headline":"Denial of service in n/a","id":"CVE-2014-9826","kev_date_added":null,"published":"2017-03-30"},{"cvss_score":9.8,"headline":"Null dereference in n/a","id":"CVE-2016-10144","kev_date_added":null,"published":"2017-03-24"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"SUSE"},{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"openSUSE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-11-03","vendors":["ImageMagick"]},"summary":"A heap buffer overflow in ImageMagick allows attackers to execute arbitrary code via crafted image files due to incorrect memory allocation during stream seeking.","url":"https://insights.sbomify.com/CVE-2025-57807/"}