CVE-2025-53101 is a high severity (CVSS 7.4) stack buffer overflow in ImageMagick. Repeated format specifiers in a filename template make internal pointer arithmetic go below the start of a stack buffer. Versions 7.1.2-0 and 6.9.13-26 fix it, so upgrade ImageMagick and any product that bundles it.
What's affected
The GitHub advisory GHSA-qh3h-j545-h8c9 lists affected versions as anything before 7.1.2-0 and before 6.9.13-26, with 7.1.2-0 and 6.9.13-26 as the patched versions. The advisory rates it High. The weakness is listed as CWE-124, a buffer underwrite.
The record describes the issue in the mogrify command, and the advisory adds that the same issue occurs in the compare, composite, conjure, convert, identify, mogrify and montage subcommands. The affected component is the format processing in the InterpretImageFilename function in MagickCore/image.c.
The advisory also says its reporters believe the flaw has the potential to lead to code execution, under specific conditions such as disabled address space randomisation and attacker control of options and filenames. Debian published an LTS announcement that references this issue, so check your distribution for backported fixes.
How to check if you're exposed
Check the version on every host and in every container image:
magick -version
convert -version
dpkg -l | grep -i imagemagick
rpm -q ImageMagick
If the upstream version is below 7.1.2-0 (or below 6.9.13-26 on the 6.x line), compare your distribution's package release with its security notice, because a backported fix may be present under an older version number.
Then find out how your software calls ImageMagick. The advisory says exploitation needs control of options and file names, so a service that builds command lines from user input is the one to look at first. Search your code for calls to convert, mogrify and magick that include request values.
What to do now
- Inventory all hosts, containers and applications that include ImageMagick.
- Upgrade to 7.1.2-0 or 6.9.13-26 or later, or install your distribution update that fixes this CVE.
- Rebuild container images that bundle the library and redeploy them.
- Never pass user controlled strings as file name templates or options to ImageMagick commands. Use fixed names and validate input.
- Run image conversion in a sandbox or a low privilege service with limited file system access.
Why it matters
A stack buffer underwrite writes to memory before the start of a buffer, usually because of arithmetic on a pointer that goes negative. Here the code adjusts an offset for each format specifier, and several in a row push the pointer below the start. Stack memory holds return addresses, so corrupting it is a classic route to taking over a program.
The score is high rather than critical because the attacker has to control the options and file names the program uses. Many web applications that process uploads never pass user input into those fields, but some do, and image tools are commonly wired up in surprising ways. The CVE is not on the CISA Known Exploited Vulnerabilities list. Upgrading removes the question.
Quick check
Which ImageMagick commands are affected?
The advisory lists compare, composite, conjure, convert, identify, mogrify and montage.
Sources
Last reviewed: 18 October 2026.
