CVE-2025-55298
Description
A flaw was found in ImageMagick. Processing a file with a specially crafted name, specifically one with format specifiers such as %d, %o, or %x, can trigger a format string bug due to improper input sanitization, resulting in a heap-based buffer over-read or arbitrary code execution.
Statement
This issue can cause a heap-based buffer over-read or arbitrary code execution via a crafted filename. However, default Red Hat Enterprise Linux security features such as SELinux enforcement, Address Space Layout Randomization (ASLR) and memory protections reduce the possibility of exploitation, limiting the impact to a denial of service.
Additionally, ImageMagick is not shipped in Red Hat Enterprise Linux 8, 9 and 10. Therefore, these versions are not affected by this vulnerability.
Mitigation
To prevent unintended interpretation of the filename as a format string, users can explicitly disable format string parsing by defining the filename as a literal. This can be done using the following directive:
In wrappers: filename:literal
From the command line: -define filename:literal=true
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | 8.8 | 7.5 |
| Attack Vector | Local | Network | Network |
| Attack Complexity | Low | Low | High |
| Privileges Required | None | Low | Low |
| User Interaction | Required | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | High | High | High |
| Integrity Impact | High | High | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
This issue can only be exploited remotely via an application processing files uploaded by untrusted users, which is not the case of Red Hat Enterprise Linux. Therefore, the attack vector metric is set to local. Additionally, a local user with no special privileges must process a file with a crafted name with ImageMagick programs to trigger this issue. To reflect this condition, the privileges required metric is set to none and the user interaction metric is set to required.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
Format string problems allow for information disclosure which can severely simplify exploitation of the program.
Integrity,Confidentiality,Availability
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Format string problems can result in the execution of arbitrary code, buffer overflows, denial of service, or incorrect data representation.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
