CVE-2025-57807: A Critical Flaw in ImageMagick Could Lead to RCE, PoC Available

CVE-2025-57807 is a critical flaw in ImageMagick that could lead to remote code execution, with a proof-of-concept exploit already released. Security researcher Lumina Mescuwa disclosed the heap out-of-bounds write arising from a contract mismatch between BlobStream’s SeekBlob() and WriteBlob() functions, enabling memory corruption and potential arbitrary code execution.

The issue affects the MagickCore blob subsystem, and the vulnerability is rated CVSS 9.8; the report explains that seeking forward beyond the end of the stream and then writing can copy data to memory outside the allocation, producing a deterministic heap write on 64-bit builds. According to GHSA-23hg-53q6-hqfg, exploitation demonstrated by initializing a 1-byte buffer, seeking forward 256 MiB, and writing a few bytes, immediately causing heap corruption.

The flaw has a broad reach across encode-to-memory flows and even though not all encoders use the pattern, the API permits it, creating a latent sink for developers. ImageMagick has addressed the issue in versions 7.1.2-3 and 6.9.13-29, and users and projects are strongly urged to upgrade immediately.