ImageMagick up to 7.1.2-9/7.1.2-10 TIM Image Parser coders/tim.c width/height out-of-bounds

Summaryinfo

A vulnerability was found in ImageMagick up to 7.1.2-9/7.1.2-10. It has been declared as problematic. Affected is an unknown function of the file coders/tim.c of the component TIM Image Parser. The manipulation of the argument width/height results in out-of-bounds. This vulnerability is identified as CVE-2025-66628. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in ImageMagick up to 7.1.2-9/7.1.2-10. It has been classified as problematic. Affected is some unknown processing of the file coders/tim.c of the component TIM Image Parser. The manipulation of the argument width/height with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality. CVE summarizes:

ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-66628 since 12/05/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 278375 (Linux Distros Unpatched Vulnerability : CVE-2025-66628), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 7.1.2-10 eliminates this vulnerability. Applying the patch 2dfa08e15cfd11016a79615994787b14f9048b1c is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (278375) and CERT Bund (WID-SEC-2025-2816). Once again VulDB remains the best source for vulnerability data.

Affected

• Debian Linux
• SUSE Linux
• Open Source ImageMagick

Productinfo

Type

• Image Processing Software

Name

• ImageMagick

Version

• 7.1.2-9
• 7.1.2-10

License

• open-source

Website

• Product: https://www.imagemagick.org/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion