ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4297 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4297-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     September 10, 2025                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : imagemagick     Version        : 8:6.9.11.60+dfsg-1.3+deb11u6     CVE ID         : CVE-2025-53014 CVE-2025-53019 CVE-2025-53101 CVE-2025-55154                      CVE-2025-55212 CVE-2025-55298 CVE-2025-57803 CVE-2025-57807     Debian Bug     : 1109339 1111103 1111586 1111587 1112469 1114520

    Multiple vulnerabilities were fixed in imagemagick an image manipulation     software suite.

    CVE-2025-53014

        A heap buffer overflow was found in the `InterpretImageFilename`         function. The issue stems from an off-by-one error that causes         out-of-bounds memory access when processing format strings         containing consecutive percent signs (`%%`).

    CVE-2025-53019

        ImageMagick's `magick stream` command, specifying multiple         consecutive `%d` format specifiers in a filename template         caused a memory leak

    CVE-2025-53101

        ImageMagick's `magick mogrify` command, specifying         multiple consecutive `%d` format specifiers in a filename         template caused internal pointer arithmetic to generate         an address below the beginning of the stack buffer,         resulting in a stack overflow through `vsnprintf()`.

    CVE-2025-55154

        The magnified size calculations in ReadOneMNGIMage         (in coders/png.c) are unsafe and can overflow,         leading to memory corruption.

    CVE-2025-55212

        passing a geometry string containing only a colon (:)         to montage -geometry leads GetGeometry() to set width/height         to 0. Later, ThumbnailImage() divides by these zero dimensions,         triggering a crash (SIGFPE/abort)

    CVE-2025-55298

        A format string bug vulnerability exists in InterpretImageFilename         function where user input is directly passed to FormatLocaleString         without proper sanitization. An attacker can overwrite arbitrary         memory regions, enabling a wide range of attacks from heap         overflow to remote code execution.

    CVE-2025-57803

        A 32-bit integer overflow in the BMP encoder??s scanline-stride         computation collapses bytes_per_line (stride) to a tiny         value while the per-row writer still emits 3 ? width bytes         for 24-bpp images. The row base pointer advances using the         (overflowed) stride, so the first row immediately writes         past its slot and into adjacent heap memory with         attacker-controlled bytes.

    CVE-2025-57807

        A security problem was found in SeekBlob(), which permits         advancing the stream offset beyond the current end without         increasing capacity, and WriteBlob(), which then expands by         quantum + length (amortized) instead of offset + length,         and copies to data + offset. When offset ? extent, the         copy targets memory beyond the allocation, producing a         deterministic heap write on 64-bit builds. No 2??         arithmetic wrap, external delegates, or policy settings         are required.

    For Debian 11 bullseye, these problems have been fixed in version     8:6.9.11.60+dfsg-1.3+deb11u6.

    We recommend that you upgrade your imagemagick packages.

    For the detailed security status of imagemagick please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/imagemagick

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7728-1 advisory.

    It was discovered that ImageMagick did not properly process certain format strings when interpreting image     filenames. An attacker could possibly use this issue to cause ImageMagick to crash, resulting in a denial     of service. (CVE-2025-53014)

    It was discovered that ImageMagick did not properly process certain format strings when interpreting image     filenames. An attacker could possibly use this issue to cause ImageMagick to consume resources, resulting     in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2025-53019)

    It was discovered that ImageMagick did not properly process certain format strings when interpreting image     filenames. An attacker could possibly use this issue to cause ImageMagick to crash, resulting in a denial     of service, or possibly execute arbitrary code. (CVE-2025-53101)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions     prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive     `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the     issue. (CVE-2025-53019)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02801-1 advisory.

    - CVE-2025-53014: Fixed an off-by-one error may cause an out-of-bounds memory access (bsc#1246530)
    - CVE-2025-53015: Fixed specific XMP file conversion may cause an infinite loop (bsc#1246531)
    - CVE-2025-53019: Fixed format specifiers in a filename template may cause a memory leak (bsc#1246534)
    - CVE-2025-53101: Fixed input manipulation may lead to an out-of-bound write (bsc#1246529)

    Other fix:
    - Crop filename pattern %03d no longer works in ImageMagick 7 (bsc#1247475)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02751-1 advisory.

    - CVE-2025-53014: Fixed an off-by-one error may cause an out-of-bounds memory access (bsc#1246530)
    - CVE-2025-53019: Fixed format specifiers in a filename template may cause a memory leak (bsc#1246534)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1126 advisory.

    ImageMagick is free and open-source software used for editing and manipulating digital images. Versions     prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The     issue stems from an off-by-one error that causes out-of-bounds memory access when processing format     strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue.
    (CVE-2025-53014)

    ImageMagick is free and open-source software used for editing and manipulating digital images. In versions     prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive     `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the     issue.

    Affects ImageMagick < 7.1.2-0, < 6.9.13-26 (CVE-2025-53019)

    ImageMagick is free and open-source software used for editing and manipulating digital images. In versions     prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive     `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address     below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions     7.1.2-0 and 6.9.13-26 fix the issue. (CVE-2025-53101)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2952 advisory.

    ImageMagick is free and open-source software used for editing and manipulating digital images. Versions     prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The     issue stems from an off-by-one error that causes out-of-bounds memory access when processing format     strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue.
    (CVE-2025-53014)

    ImageMagick is free and open-source software used for editing and manipulating digital images. In versions     prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive     `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the     issue.

    Affects ImageMagick < 7.1.2-0, < 6.9.13-26 (CVE-2025-53019)

    ImageMagick is free and open-source software used for editing and manipulating digital images. In versions     prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive     `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address     below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions     7.1.2-0 and 6.9.13-26 fix the issue. (CVE-2025-53101)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02511-1 advisory.

    - CVE-2025-53014: Fixed an off-by-one error may cause an out-of-bounds memory access (bsc#1246530)
    - CVE-2025-53015: Fixed specific XMP file conversion may cause an infinite loop (bsc#1246531)
    - CVE-2025-53019: Fixed format specifiers in a filename template may cause a memory leak (bsc#1246534)
    - CVE-2025-53101: Fixed input manipulation may lead to an out-of-bound write (bsc#1246529)

    Changed policies:

        * allow ImageMagick to read it's own files again (bsc#1246065)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02510-1 advisory.

    - CVE-2025-53014: Fixed an off-by-one error may cause an out-of-bounds memory access (bsc#1246530)
    - CVE-2025-53019: Fixed format specifiers in a filename template may cause a memory leak (bsc#1246534)
    - CVE-2025-53101: Fixed input manipulation may lead to an out-of-bound write (bsc#1246529)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host has a version of ImageMagick installed that prior to 6.9.13-26 or 7.1 prior to 7.1.2. It is, therefore, affected by multiple vulnerabilites:

  - filename template issues can cause a stack overflow     through vsnprintf() (CVE-2025-53101)

  - heap buffer overflow in the InterpretImageFilename     function (CVE-2025-53014)

  - Improper filename template can cause a memory leak     (CVE-2025-53019)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
264502	Debian dla-4297 : imagemagick - security update	Nessus	Debian Local Security Checks	critical
260923	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : ImageMagick vulnerabilities (USN-7728-1)	Nessus	Ubuntu Local Security Checks	critical
253534	Linux Distros Unpatched Vulnerability : CVE-2025-53019	Nessus	Misc.	low
250269	SUSE SLED15 / SLES15 Security Update : ImageMagick (SUSE-SU-2025:02801-1)	Nessus	SuSE Local Security Checks	high
249089	SUSE SLES12 Security Update : ImageMagick (SUSE-SU-2025:02751-1)	Nessus	SuSE Local Security Checks	low
243489	Amazon Linux 2023 : ImageMagick, ImageMagick-c++, ImageMagick-c++-devel (ALAS2023-2025-1126)	Nessus	Amazon Linux Local Security Checks	high
243427	Amazon Linux 2 : ImageMagick (ALAS-2025-2952)	Nessus	Amazon Linux Local Security Checks	high
242841	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : ImageMagick (SUSE-SU-2025:02511-1)	Nessus	SuSE Local Security Checks	high
242839	SUSE SLED15 / SLES15 Security Update : ImageMagick (SUSE-SU-2025:02510-1)	Nessus	SuSE Local Security Checks	high
242329	ImageMagick < 6.9.13-26 / 7.1.0 < 7.1.2 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2025-53019

low

Tenable Plugins

critical

critical

low

high

low

high

high

high

high

high