Critical ImageMagick Vulnerability Allows Remote Code Execution

A critical security vulnerability has been discovered in ImageMagick, the open-source image processing software, tracked as CVE-2025-57803 with a severity of 9.8 out of 10. The flaw arises from a 32-bit integer overflow in ImageMagick’s BMP encoder (WriteBMPImage), which can lead to a heap buffer overflow when processing BMP images. It affects 32-bit builds of ImageMagick versions before 7.1.2-2 and 6.9.13-28, while 64-bit installations are not affected by this specific overflow.

The attack can be triggered through network-accessible image conversion services without authentication, and the resulting mismatch between expected and actual data can allow remote code execution, denial of service, or memory corruption in vulnerable environments. Immediate action is to update to patched versions: 7.1.2-2 or later for the 7.x branch and 6.9.13-28 or later for the 6.x branch.