CVE-2025-53014: Low Heap Overflow in ImageMagick Filenames

CVE-2025-53014 is a low severity (CVSS 3.7) heap buffer overflow in ImageMagick. An off-by-one error in the InterpretImageFilename function reads out of bounds when a format string contains consecutive percent signs. Versions 7.1.2-0 and 6.9.13-26 fix it, so upgrade ImageMagick and any package that bundles it.

What's affected

The GitHub advisory GHSA-hm4x-r5hc-794f lists affected versions as anything before 7.1.2-0 and before 6.9.13-26, with 7.1.2-0 and 6.9.13-26 as the patched versions. The advisory rates it Low. The record describes it as an out-of-bounds read (CWE-125) caused by an off-by-one error (CWE-193).

Debian published a long term support announcement that references this issue, so distribution packages carry backported fixes under their own version numbers. A package that reports an older upstream version may therefore already be fixed. Check your distribution's security tracker for the package version that contains the fix.

ImageMagick is also built into other software, such as image processing libraries for web frameworks and document converters. Those copies are easy to miss.

How to check if you're exposed

Start with the version on each host:

magick -version
convert -version
dpkg -l | grep -i imagemagick
rpm -q ImageMagick

Use whichever applies on your platform. If the upstream version is below 7.1.2-0 (or below 6.9.13-26 on the 6.x line), compare the distribution package release against your vendor's advisory before you decide.

Then look for copies that your package manager does not show. Container images, language bindings and statically linked tools can carry their own ImageMagick. Scan the image or the project dependencies and look for ImageMagick, MagickWand or Magick.NET.

What to do now

1. Inventory every host, container and application that includes ImageMagick.
2. Upgrade to 7.1.2-0 or 6.9.13-26 or later, or install your distribution update that lists this CVE as fixed.
3. Rebuild and redeploy container images that bundle the library.
4. Avoid letting untrusted users control format strings or output file name templates passed to ImageMagick commands.
5. Re-scan after the upgrade to confirm the old version is gone.

Why it matters

An off-by-one error means a program counts or indexes one position past where it should. Here, handling two percent signs in a row reads a byte beyond the intended buffer. The score is low because the impact is limited and the conditions are narrow, but memory safety bugs in a library that parses many formats are worth cleaning up.

The practical risk depends on how your application calls ImageMagick. If file names or format strings come from users, the code path is reachable. If they are fixed by your code, reachability is much lower. This is where reachability analysis helps. It tells you whether your code calls the affected function so that you can spend your time on findings that matter. The CVE is not on the CISA Known Exploited Vulnerabilities list.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GitHub advisory GHSA-hm4x-r5hc-794f
• Debian LTS announcement
• Safeguard Gold entry

Last reviewed: 18 October 2026.