CVE-2025-66628ImageMagick is vulnerable to an Integer Overflow in TIM decoder leading to out of bounds read (32-bit only)
- 7.5HighCVSS base score
- 0.55%Exploitation in 30 daysEPSS · top 54% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10.
Timeline
ID reserved
By GitHub_M
- 5 days later
· 5 days later
Published
- 1 day later
· 1 day later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVDNVD · Analyzed | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.55% · top 54% of all CVEs (15 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Affected products
- affected < 7.1.2-10
Affected packages
Affected packages6
From reviewed advisories of the GitHub Advisory Database.
- NuGetMagick.NET-Q16-AnyCPUGHSA-6hjr-v6g4-3fm8 (opens in a new tab)
- NuGetMagick.NET-Q16-HDRI-AnyCPUGHSA-6hjr-v6g4-3fm8 (opens in a new tab)
- NuGetMagick.NET-Q16-HDRI-x86GHSA-6hjr-v6g4-3fm8 (opens in a new tab)
- NuGetMagick.NET-Q16-x86GHSA-6hjr-v6g4-3fm8 (opens in a new tab)
- NuGetMagick.NET-Q8-AnyCPUGHSA-6hjr-v6g4-3fm8 (opens in a new tab)
- NuGetMagick.NET-Q8-x86GHSA-6hjr-v6g4-3fm8 (opens in a new tab)
References
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-202428 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-6hjr-v6g4-3fm8 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-66628)Record last updated .