Memory Corruption in ImageMagick's Magick++ Layer Affecting Open Source Software
CVE-2025-65955

4.9MEDIUM

Key Information:

Vendor

Imagemagick
Status
Imagemagick
Vendor
CVE Published:
2 December 2025

What is CVE-2025-65955?

A vulnerability exists in the Magick++ layer of ImageMagick when Options::fontFamily is called with an empty string. This improper handling leads to memory corruption, as the cleanup process of the font family attempts to access a freed memory pointer. Subsequent operations on this dangling pointer can cause crashes or lead to heap corruption in the application. Fixes have been introduced in versions 7.1.2-9 and 6.9.13-34 to prevent this issue.

Affected Version(s)

ImageMagick >= 7.0.1-0, < 7.1.2-9 < 7.0.1-0, 7.1.2-9

ImageMagick < 6.9.13-34 < 6.9.13-34

References

https://github.com/ImageMagick/ImageMagick/security/advis...
x_refsource_CONFIRM
https://github.com/ImageMagick/ImageMagick/commit/6409f34...
x_refsource_MISC
https://github.com/ImageMagick/ImageMagick/commit/6f81eb1...
x_refsource_MISC

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.