ImageMagick Flaw Risks Arbitrary Memory Disclosure via PSX TIM File Integer Overflow on 32-bit Systems

ImageMagick has a high-severity flaw, CVE-2025-66628, that could enable Arbitrary Memory Disclosure on 32-bit systems by abusing the TIM image format, with CVSS 7.5. The issue lies in the ReadTIMImage function, which calculates image_size as 2 * width * height without overflow checks, so large dimensions such as 65535 x 65535 can cause a wraparound and a small heap allocation via AcquireQuantumMemory, followed by an out-of-bounds read.

According to the vulnerability report, this can allow attackers to read memory contents from adjacent blocks, potentially exposing passwords, keys, or other sensitive data. The flaw affects ImageMagick versions prior to 7.1.2-9, and the maintainers patched it in version 7.1.2-10 to add proper overflow checks. Administrators running ImageMagick on 32-bit architectures, including legacy servers and certain IoT devices, are urged to upgrade immediately.

The article was published on 15 December 2025 and notes the fix and the exposure risk, urging action for affected deployments. According to CVE Watchtower.