UpHeron
All vulnerabilities

Servers and applications

CVE-2025-55154

Heap Buffer Over-Write in MGN decoder on 32-bit systems

Severity
High 7.8
Published
13 Aug 2025
Last changed
10 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
6.9.13-27, 6.9.13-58, 7.1.2-1, 7.1.2-33
Also known as
GHSA-j2rp-5r6m-f7x8
Sources
NVD, Project advisories (GitHub)

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1.

Affected software

SoftwareAffected versions
ImageMagickServers and applications · cpe:a:imagemagick:imagemagick
  • Every version before 6.9.13-27
  • From 7.0.0-0 before 7.1.2-1
ImageMagickServers and applications · github:imagemagick/imagemagick
  • Every version before 7.1.2-33
  • Every version before 6.9.13-58

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-55154
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-55154
  • GitHub Advisory Database https://github.com/advisories/GHSA-j2rp-5r6m-f7x8
  • github.com https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j2rp-5r6m-f7x8