CVE-2025-46393

Vulnerability

In ImageMagick before version 7.1.1-44, a heap corruption vulnerability exists in the processing of multispectral MIFF (Magick Image File Format) images. The issue stems from incorrect calculation of packet_size in the ReadMIFFImage and WriteMIFFImage functions. Prior to the fix, when image->number_meta_channels was non-zero, packet_size was incorrectly incremented by image->number_meta_channels * image->depth / 8 instead of being recalculated to account for all channels. The correct formula should set packet_size = GetImageChannels(image) * image->depth / 8 to properly size the buffer for reading or writing all channels (including meta channels) in an arbitrary order. The affected versions are ImageMagick prior to 7.1.1-44 [1][2].

Exploitation

An attacker can exploit this vulnerability by crafting a specially crafted multispectral MIFF image file with meta channels. The attacker needs no special privileges beyond the ability to provide this image file to an application using ImageMagick for processing. The application must process the image using the MIFF reading or writing code path (e.g., using ReadMIFFImage or WriteMIFFImage). No user interaction is required beyond opening the file. The flawed packet size calculation leads to a heap buffer that is smaller than required, which may cause out-of-bounds writes when rendering channels in arbitrary order [1][2].

Impact

Successful exploitation can lead to heap corruption, potentially resulting in a denial of service (crash) or arbitrary code execution in the context of the application processing the image. The impact depends on the heap layout and specifics of the application using ImageMagick. As this is a memory corruption vulnerability, the confidentiality, integrity, and availability of the system could be compromised [1][2].

Mitigation

The vulnerability is fixed in ImageMagick version 7.1.1-44, released on 2025-02-22. Users should upgrade to this version or later. The fix is implemented in commit 81ac8a0d2eb21739842ed18c48c7646b7eef65b8 [1][2]. For systems that cannot be immediately updated, users should avoid processing MIFF images from untrusted sources, though this is not a complete workaround as other image formats may also be affected by similar issues (this CVE is specific to the MIFF code path). The advisory is available in the ImageMagick changelog [1].