Integer Overflow Vulnerability in ImageMagick Software Suite

CVE-2025-66628

What is CVE-2025-66628?

An integer overflow vulnerability exists in the TIM image parser of ImageMagick, affecting versions 7.1.2-9 and earlier. The flaw is located in the ReadTIMImage function, where the calculations for image size derived from the width and height can lead to incorrect memory allocation. When large values for width and height are processed, this can cause the size calculation to wrap around, resulting in insufficient memory being allocated. Consequently, subsequent operations that depend on these dimensions may access out-of-bounds areas of memory, potentially leading to unauthorized data access or exploitation.

References