ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. …
Exact source revision recorded 5 Nov 2026 02:54:55 UTC. It does not establish the source's current position. Latest evidence.
euvd · EUVD-2025-34893
PublishedImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. The vulnerability is fixed in versions 7.1.2-7 and 6.9.13-32.
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields
datePublished: Oct 17, 2025, 4:30:27 PM
dateUpdated: Nov 3, 2025, 5:45:24 PM
9 related source bulletins · separate from aliases
WID-SEC-W-2025-2339: ImageMagick (BMP decoder): Schwachstelle ermöglicht Denial of Service
CVE-2025-62171
openSUSE-SU-2025:15650-1: ImageMagick-7.1.2.7-1.1 on GA media
CVE-2025-62171
SUSE-SU-2025:3844-1: Security update for ImageMagick
CVE-2025-62171
SUSE-SU-2025:3796-1: Security update for ImageMagick
CVE-2025-62171
openSUSE-SU-2025:20162-1: Security update for ImageMagick
CVE-2025-55212 · CVE-2025-55298 · CVE-2025-57803 · CVE-2025-57807 · CVE-2025-62171 · CVE-2025-62594
SUSE-SU-2025:21211-1: Security update for ImageMagick
CVE-2025-55212 · CVE-2025-55298 · CVE-2025-57803 · CVE-2025-57807 · CVE-2025-62171 · CVE-2025-62594
RHSA-2026:3058: Red Hat Security Advisory: ImageMagick security update
CVE-2025-62171 · CVE-2026-23876
SUSE-SU-2025:3918-1: Security update for ImageMagick
CVE-2025-62171
SUSE-SU-2025:3867-1: Security update for ImageMagick
CVE-2025-62171
- Source published
- Oct 17, 2025, 4:30:27 PM (timezone not stated)
- Source modified
- Nov 3, 2025, 5:45:24 PM (timezone not stated)
- Observed here
- 5 Nov 2026 02:54:55 UTC
- Source terms
- ENISA EUVD · source terms and attribution apply
Original source record · Cite this exact observation · Complete original publisher JSON
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.
EUVD CVSS 3.1 · 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H