ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crash

CVE-2025-55212 describes a denial-of-service vulnerability in ImageMagick, a widely used open-source image processing suite [1]. The issue resides in the GetGeometry() function within MagickCore/geometry.c (referenced by [2] and [4]). When a geometry string consisting solely of a colon (:) is passed to the montage -geometry command, the parsing routine StringToDouble interprets the string as 0.0. Consequently, GetGeometry() sets the width and height values to zero, which are later used as divisors in the ThumbnailImage() function [3].

Exploitation is straightforward and does not require any special authentication or network access. An attacker can trigger the vulnerability locally simply by running the command montage -geometry : xc:white null:, using the built-in xc:white pseudo-image as input [3]. Because no external file is required, the attack surface is large; any service or automated process that accepts user-supplied geometry strings for montage could be compromised.

The impact is a denial of service. The division-by-zero in ThumbnailImage() causes an immediate crash — typically a SIGFPE (floating-point exception) or an abort — leading to abnormal termination of the ImageMagick process [3]. This can be used to disrupt image processing pipelines, web applications using ImageMagick for thumbnail generation, or other automated workflows.

A patch has been released. Versions 6.9.13-28 and 7.1.2-2 contain the fix [3]. All users running earlier versions are advised to update immediately. No workaround is available other than filtering or rejecting geometry strings that contain only a colon before they reach montage.