CVE-2025-57807 is a low severity (CVSS 3.8) heap write in ImageMagick. In versions before 14.8.2, SeekBlob can move the stream offset past the end of a buffer and WriteBlob then copies data beyond the allocation. The fix is in 14.8.2, and Debian has published a long term support notice.
What's affected
ImageMagick versions lower than 14.8.2, per the record and the GitHub advisory. The fixed version is 14.8.2.
The record states that no 64-bit arithmetic wrap, external delegate or policy setting is needed to reach the bug on 64-bit builds.
Distributions backport fixes without changing the upstream version number, so a package that reports an older number may still be patched. The Debian LTS announcement is the place to check for Debian based systems.
How to check if you're exposed
Check the version on each host that converts or resizes images.
magick -version | head -n 1
convert -version | head -n 1
dpkg -l | grep -i imagemagick
rpm -qa | grep -i imagemagick
Also look for ImageMagick inside application bundles and container images, such as language bindings (Wand, RMagick, imagick) that link to the system library. A vulnerable library can sit behind a service that never mentions ImageMagick in its own manifest.
What to do now
- Inventory every host, container image and language binding that uses ImageMagick.
- Upgrade to 14.8.2 or later, or install your distribution's patched package. For Debian systems, read the LTS announcement first.
- Rebuild container images that bundle ImageMagick and redeploy them.
- If you accept image uploads from users, keep a restrictive ImageMagick policy file that limits the formats you process.
- Keep management and configuration interfaces off the internet and off guest networks.
- Record the firmware or build version of every affected device so you can match it to a fix when one is published.
Why it matters
The bug is a mismatch between two functions. SeekBlob let the write position move beyond the end of the buffer without growing it. WriteBlob then sized its growth from the current length rather than from the new offset, and copied data to the far position. The result is a write outside the allocated heap memory.
The score is low because the vector requires local access, high privileges and user interaction. Even so, ImageMagick often sits behind upload handlers, so it is worth patching as part of normal maintenance instead of leaving it for later.
The record classifies the weakness as CWE-122 (Heap-based Buffer Overflow) and CWE-131 (Incorrect Calculation of Buffer Size) and CWE-787 (Out-of-bounds Write).
Memory corruption bugs like this one come from copying more data into a fixed region than it can hold, or reading and writing at a position that was never checked. Depending on the target, the result ranges from a crash to a change in program behavior. Embedded and native code is hit hardest because there is usually no managed runtime to catch the mistake.
The lasting fix is a bounds check on every length or index that arrives from outside the component. Until that fix ships, the practical defense is to limit who can reach the vulnerable code path at all, which usually means keeping management interfaces and internal services off untrusted networks.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why is the severity low if it is a heap write?
The CVSS vector requires local access, high privileges and user interaction, which lowers the score. Memory corruption is still worth patching.
Which version fixes it?
ImageMagick 14.8.2. Check your distribution for a backported package.
Sources
Last reviewed: 18 October 2026.
