CVE-2025-57803: Critical Flaw in ImageMagick Could Lead to Remote Code Execution

CVE-2025-57803 is a critical vulnerability in ImageMagick’s BMP encoder that can lead to heap corruption and potentially remote code execution, with a CVSS score of 9.8 (Critical). The flaw affects 32-bit builds of ImageMagick prior to versions 7.1.2-2 and 6.9.13-28, caused by a 32-bit integer overflow in the calculation of BMP scanline stride values.

According to the advisory, a mismatch between the computed stride and the bytes per line can cause an attacker-controlled data write to overflow into adjacent heap memory, described as a “classic, powerful primitive for heap corruption in common auto-convert pipelines.” In tests, a width of 178,957,200 pixels could allocate around 178 MB but try to write 536 MB, overflowing almost immediately, with the advisory warning that the outcome includes at minimum a crash and, on many 32-bit allocators, potential RCE.

Users running 32-bit builds are urged to upgrade immediately to 7.1.2-2 or 6.9.13-28, while 64-bit builds are immune to the overflow itself but still require checks to guard against DoS scenarios.