Heap-based Buffer Overflow Affecting ImageMagick-perl package, versions <1:6.9.12.82-1.amzn2023.0.11


Severity

Recommended
0.0
high
0
10

Based on Amazon Linux security rating.

Threat Intelligence

EPSS
0.04% (10th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-AMZN2023-IMAGEMAGICKPERL-12764406
  • published16 Sept 2025
  • disclosed13 Aug 2025

Introduced: 13 Aug 2025

CVE-2025-55004  (opens in a new tab)
CWE-122  (opens in a new tab)

How to fix?

Upgrade Amazon-Linux:2023 ImageMagick-perl to version 1:6.9.12.82-1.amzn2023.0.11 or higher.
This issue was patched in ALAS2023-2025-1182.

NVD Description

Note: Versions mentioned in the description apply only to the upstream ImageMagick-perl package and not the ImageMagick-perl package as distributed by Amazon-Linux. See How to fix? for Amazon-Linux:2023 relevant fixed versions and status.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, ImageMagick is vulnerable to heap-buffer overflow read around the handling of images with separate alpha channels when performing image magnification in ReadOneMNGIMage. This can likely be used to leak subsequent memory contents into the output image. This issue has been patched in version 7.1.2-1.

CVSS Base Scores

version 3.1