ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-9 and 6.9.13-34, there is a vulnerability in ImageMagick’s Magick++ layer that manifests when Options::fontFamily is invoked with an empty string. Clearing a font family calls RelinquishMagickMemory on _drawInfo->font, freeing the font string but leaving _drawInfo->font pointing to freed memory while _drawInfo->family is set to that (now-invalid) pointer. Any later cleanup or reuse of _drawInfo->font re-frees or dereferences dangling memory. DestroyDrawInfo and other setters (Options::font, Image::font) assume _drawInfo->font remains valid, so destruction or subsequent updates trigger crashes or heap corruption. This vulnerability is fixed in 7.1.2-9 and 6.9.13-34.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1319 advisory.

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-9 and 6.9.13-34, there is a vulnerability in ImageMagick's Magick++ layer that manifests when     Options::fontFamily is invoked with an empty string. Clearing a font family calls RelinquishMagickMemory     on _drawInfo->font, freeing the font string but leaving _drawInfo->font pointing to freed memory while
    _drawInfo->family is set to that (now-invalid) pointer. Any later cleanup or reuse of _drawInfo->font re-     frees or dereferences dangling memory. DestroyDrawInfo and other setters (Options::font, Image::font)     assume _drawInfo->font remains valid, so destruction or subsequent updates trigger crashes or heap     corruption. This vulnerability is fixed in 7.1.2-9 and 6.9.13-34. (CVE-2025-65955)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0011-1 advisory.

    - CVE-2025-65955: possible use-after-free/double-free in `Options::fontFamily` when clearing a family can     lead to       crashes or memory corruption (bsc#1254435).
    - CVE-2025-66628: possible integer overflow in the TIM image parser's `ReadTIMImage` function can lead to     arbitrary       memory disclosure on 32-bit systems (bsc#1254820).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0013-1 advisory.

    - CVE-2025-65955: possible use-after-free/double-free in `Options::fontFamily` when clearing a family can     lead to       crashes or memory corruption (bsc#1254435).
    - CVE-2025-66628: possible integer overflow in the TIM image parser's `ReadTIMImage` function can lead to     arbitrary       memory disclosure on 32-bit systems (bsc#1254820).
    - CVE-2025-68469: crash due to heap buffer overflow when processing a specially crafted TIFF file     (bsc#1255391).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3096 advisory.

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-9 and 6.9.13-34, there is a vulnerability in ImageMagick's Magick++ layer that manifests when     Options::fontFamily is invoked with an empty string. Clearing a font family calls RelinquishMagickMemory     on _drawInfo->font, freeing the font string but leaving _drawInfo->font pointing to freed memory while
    _drawInfo->family is set to that (now-invalid) pointer. Any later cleanup or reuse of _drawInfo->font re-     frees or dereferences dangling memory. DestroyDrawInfo and other setters (Options::font, Image::font)     assume _drawInfo->font remains valid, so destruction or subsequent updates trigger crashes or heap     corruption. This vulnerability is fixed in 7.1.2-9 and 6.9.13-34. (CVE-2025-65955)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4429 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4429-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     December 31, 2025                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : imagemagick     Version        : 8:6.9.11.60+dfsg-1.3+deb11u8     CVE ID         : CVE-2025-65955 CVE-2025-66628 CVE-2025-68469 CVE-2025-68618                      CVE-2025-68950 CVE-2025-69204     Debian Bug     : 1122584 1122827

    Multiple vulnerabilities were fixed in imagemagick a popular image     processing suite.

    CVE-2025-65955

         A vulnerability was found in ImageMagick??s Magick++ layer that         manifests when Options::fontFamily is invoked with an empty         string. Clearing a font family calls RelinquishMagickMemory on
        _drawInfo->font, freeing the font string but leaving _drawInfo->font         pointing to freed memory while _drawInfo->family is set to that         (now-invalid) pointer. Any later cleanup or reuse of _drawInfo->font         re-frees or dereferences dangling memory. DestroyDrawInfo and other         setters (Options::font, Image::font) assume _drawInfo->font remains         valid, so destruction or subsequent updates trigger crashes or heap         corruption

    CVE-2025-66628

        The TIM (PSX TIM) image parser contains a critical integer overflow         vulnerability in its ReadTIMImage function (coders/tim.c). The code         reads width and height (16-bit values) from the file header and         calculates image_size = 2 * width * height without checking for         overflow. On 32-bit systems (or where size_t is 32-bit), this         calculation can overflow if width and height are large (e.g., 65535),         wrapping around to a small value

    CVE-2025-68469

        ImageMagick crashes when processing a crafted TIFF file

    CVE-2025-68618

        Magick's failure to limit the depth of SVG file reads caused         a DoS attack.

    CVE-2025-68950

        Magick's failure to limit MVG mutual references forming a loop

    CVE-2025-69204

        Converting a malicious MVG file to SVG caused an integer overflow.

    For Debian 11 bullseye, these problems have been fixed in version     8:6.9.11.60+dfsg-1.3+deb11u8.

    We recommend that you upgrade your imagemagick packages.

    For the detailed security status of imagemagick please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/imagemagick

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the ImageMagick package has been released.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4427-1 advisory.

    - CVE-2025-65955: possible use-after-free/double-free in `Options::fontFamily` when clearing a family can     lead to       crashes or memory corruption (bsc#1254435).
    - CVE-2025-66628: possible integer overflow in the TIM image parser's `ReadTIMImage` function can lead to     arbitrary       memory disclosure on 32-bit systems (bsc#1254820).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4428-1 advisory.

    - CVE-2025-65955: possible use-after-free/double-free in `Options::fontFamily` when clearing a family can     lead to       crashes or memory corruption (bsc#1254435).
    - CVE-2025-66628: possible integer overflow in the TIM image parser's `ReadTIMImage` function can lead to     arbitrary       memory disclosure on 32-bit systems (bsc#1254820).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host has a version of ImageMagick installed that is prior to 6.9.13-34 or 7.1.2-9. It is, therefore, affected by use-after-free and double-free vulnerabilities as referenced in the GHSA-q3hc-j9x5-mp9m advisory.

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior     to 7.1.2-9 and 6.9.13-34, there is a vulnerability in ImageMagick's Magick++ layer that manifests     when Options::fontFamily is invoked with an empty string. Clearing a font family calls     RelinquishMagickMemory on _drawInfo->font, freeing the font string but leaving _drawInfo->font     pointing to freed memory while _drawInfo->family is set to that (now-invalid) pointer. Any later     cleanup or reuse of _drawInfo->font re-frees or dereferences dangling memory. DestroyDrawInfo and     other setters (Options::font, Image::font) assume _drawInfo->font remains valid, so destruction or     subsequent updates trigger crashes or heap corruption. This vulnerability is fixed in 7.1.2-9 and     6.9.13-34. (CVE-2025-65955)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-9 and 6.9.13-34, there is a vulnerability in ImageMagick's Magick++ layer that manifests when     Options::fontFamily is invoked with an empty string. Clearing a font family calls RelinquishMagickMemory     on _drawInfo->font, freeing the font string but leaving _drawInfo->font pointing to freed memory while
    _drawInfo->family is set to that (now-invalid) pointer. Any later cleanup or reuse of _drawInfo->font re-     frees or dereferences dangling memory. DestroyDrawInfo and other setters (Options::font, Image::font)     assume _drawInfo->font remains valid, so destruction or subsequent updates trigger crashes or heap     corruption. This vulnerability is fixed in 7.1.2-9 and 6.9.13-34. (CVE-2025-65955)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
282376	Amazon Linux 2023 : ImageMagick, ImageMagick-c++, ImageMagick-c++-devel (ALAS2023-2025-1319)	Nessus	Amazon Linux Local Security Checks	medium
281852	SUSE SLES15 / openSUSE 15 Security Update : ImageMagick (SUSE-SU-2026:0011-1)	Nessus	SuSE Local Security Checks	high
281834	SUSE SLED15 / SLES15 Security Update : ImageMagick (SUSE-SU-2026:0013-1)	Nessus	SuSE Local Security Checks	medium
281804	Amazon Linux 2 : ImageMagick, --advisory ALAS2-2025-3096 (ALAS-2025-3096)	Nessus	Amazon Linux Local Security Checks	medium
281533	Debian dla-4429 : imagemagick - security update	Nessus	Debian Local Security Checks	medium
279471	Photon OS 4.0: Imagemagick PHSA-2025-4.0-0929	Nessus	PhotonOS Local Security Checks	medium
279069	SUSE SLED15 / SLES15 Security Update : ImageMagick (SUSE-SU-2025:4427-1)	Nessus	SuSE Local Security Checks	high
279052	SUSE SLES15 Security Update : ImageMagick (SUSE-SU-2025:4428-1)	Nessus	SuSE Local Security Checks	high
278949	Photon OS 5.0: Imagemagick PHSA-2025-5.0-0714	Nessus	PhotonOS Local Security Checks	high
277548	ImageMagick < 6.9.13-34 / 7.x < 7.1.2-9 Use-After-Free / Double-Free (GHSA-q3hc-j9x5-mp9m)	Nessus	Misc.	medium
277363	Linux Distros Unpatched Vulnerability : CVE-2025-65955	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-65955

medium

Tenable Plugins

medium

high

medium

medium

medium

medium

high

high

high

medium

medium