CVE-2025-55004
Public on 2025-08-13
        Modified on 2025-08-14
        
      Description
            
              ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, ImageMagick is vulnerable to heap-buffer overflow read around the handling of images with separate alpha channels when performing image magnification in ReadOneMNGIMage. This can likely be used to leak subsequent memory contents into the output image. This issue has been patched in version 7.1.2-1.
            
          Severity
          
          See what this means
        CVSS v3 Base Score
          
          See breakdown
        Affected Packages
| Platform | Package | Release Date | Advisory | Status | 
|---|---|---|---|---|
| Amazon Linux 1 | ImageMagick | No Fix Planned | ||
| Amazon Linux 2 - Core | ImageMagick | 2025-09-16 | ALAS2-2025-3000 | Fixed | 
| Amazon Linux 2023 | ImageMagick | 2025-09-15 | ALAS2023-2025-1182 | Fixed | 
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 6.6 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L | 
| NVD | CVSSv3 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |