ImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code execution

Summary

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.

Timeline

1. Aug 26, 2025, 5:20 PM UTCCVE published
2. Aug 26, 2025, 8:36 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: no · Technical impact: total

3. Nov 3, 2025, 6:13 PM UTCRecord last updated

Affected versions

• ImageMagick ImageMagick

  fixed in 7.1.2-2; fixed in 6.9.13-28

• Magick.NET-Q16-AnyCPUNuGet

  fixed in 14.8.1

• Magick.NET-Q16-HDRI-AnyCPUNuGet

  fixed in 14.8.1

• Magick.NET-Q16-HDRI-OpenMP-arm64NuGet

  fixed in 14.8.1

• Magick.NET-Q16-HDRI-OpenMP-x64NuGet

  fixed in 14.8.1

• Magick.NET-Q16-HDRI-arm64NuGet

  fixed in 14.8.1

• Magick.NET-Q16-HDRI-x64NuGet

  fixed in 14.8.1

• Magick.NET-Q16-HDRI-x86NuGet

  fixed in 14.8.1

• Magick.NET-Q16-OpenMP-arm64NuGet

  fixed in 14.8.1

• Magick.NET-Q16-OpenMP-x64NuGet

  fixed in 14.8.1

• Magick.NET-Q16-arm64NuGet

  fixed in 14.8.1

• Magick.NET-Q16-x64NuGet

  fixed in 14.8.1

• Magick.NET-Q16-x86NuGet

  fixed in 14.8.1

• Magick.NET-Q8-AnyCPUNuGet

  fixed in 14.8.1

• Magick.NET-Q8-OpenMP-arm64NuGet

  fixed in 14.8.1

• Magick.NET-Q8-OpenMP-x64NuGet

  fixed in 14.8.1

• Magick.NET-Q8-arm64NuGet

  fixed in 14.8.1

• Magick.NET-Q8-x64NuGet

  fixed in 14.8.1

• Magick.NET-Q8-x86NuGet

  fixed in 14.8.1

References 3