CVE-2025-66628

HIGH

ImageMagick <7.1.9 - Buffer Overflow

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-66628. PoCs published by Sumitshah00.

AI-analyzed exploit summary This repository contains a detailed writeup for CVE-2025-66628, an integer overflow vulnerability in ImageMagick's TIM parser affecting 32-bit systems. The vulnerability allows out-of-bounds reads due to unchecked multiplication of user-controlled width and height values.

Description

ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10.

Exploits (1)

nomisec WRITEUP 1 stars
by Sumitshah00 · poc
https://github.com/Sumitshah00/CVE-2025-66628

This repository contains a detailed writeup for CVE-2025-66628, an integer overflow vulnerability in ImageMagick's TIM parser affecting 32-bit systems. The vulnerability allows out-of-bounds reads due to unchecked multiplication of user-controlled width and height values.

Classification
Writeup 100%
Attack Type
Info Leak | Dos
Complexity
Moderate
Reliability
Reliable
Target: ImageMagick < 7.1.2-10
No auth needed
Prerequisites: ImageMagick version < 7.1.2-10 compiled for 32-bit architecture · Maliciously crafted TIM file with specific dimensions
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Scores

CVSS v3 7.5
EPSS 0.0005
EPSS Percentile 15.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-125
Status published
Products (7)
imagemagick/imagemagick < 7.1.2-10
nuget/Magick.NET-Q16-AnyCPU 0 - 14.10.0NuGet
nuget/Magick.NET-Q16-HDRI-AnyCPU 0 - 14.10.0NuGet
nuget/Magick.NET-Q16-HDRI-x86 0 - 14.10.0NuGet
nuget/Magick.NET-Q16-x86 0 - 14.10.0NuGet
nuget/Magick.NET-Q8-AnyCPU 0 - 14.10.0NuGet
nuget/Magick.NET-Q8-x86 0 - 14.10.0NuGet
Published Dec 10, 2025
Tracked Since Feb 18, 2026