ImageMagick BlobStream Forward-Seek Under-Allocation

Vulnerability

Overview CVE-2025-57807 is a heap out-of-bounds write vulnerability in ImageMagick's BlobStream I/O subsystem (MagickCore/blob.c). The root cause is a contract mismatch between the SeekBlob() and WriteBlob() functions for memory-backed blobs. SeekBlob() allows advancing the stream offset beyond the current end of the allocated buffer without increasing the buffer's capacity [1]. When WriteBlob() is subsequently called, it calculates the required size using an amortized growth formula (quantum + length) instead of ensuring the new extent covers offset + length. This leads to reallocation that is smaller than needed [1][4].

Exploitation

Path An attacker can reach this vulnerability by providing a crafted image file that triggers a seek to a large offset (e.g., 256 MiB) followed by a small write. No authentication, special policies, or 2^64 arithmetic overflow are required [1]. The vulnerability is reachable over the network if ImageMagick processes untrusted images, as is common in web applications that use the library [2].

Impact

Successful exploitation results in a deterministic heap write where an attacker-controlled number of bytes are written to a heap location determined by the attacker's chosen offset. This memory corruption can potentially lead to arbitrary code execution or other serious security impacts [1]. The CVSS v3.1 base score is 9.8 (Critical) [1].

Mitigation

The vulnerability is fixed in ImageMagick version 14.8.2 [1][2]. The fix changes the reallocation calculation in WriteBlob() to use extent = offset + length + quantum, ensuring the buffer is sized to cover the actual write target [4]. Users should update to the patched version or apply the corresponding commit.