imagemagick: heap-buffer overflow read in MNG magnification with alpha

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

7.6 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

EPSS

• CVE-2025-55004: 0.55% estimated exploitation activity in the next 30 days; percentile 45.97 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Vulnerability Details When performing image magnification in ReadOneMNGIMage (in coders/png.c), there is an issue around the handling of images with separate alpha channels. When loading an image with a color type that implies a separate alpha channel (ie. jngcolortype = 12), we will load the alpha pixels in this loop: Note that at \[1\] we update image-alphatrait, but if our alpha image only contains non-opaque pixels in the last row, we do not call GetAuthenticPixels (at \[0\]) after this change has been made. The next call to GetAuthenticPixels will then call down into ResetPixelChannelMap which adds the new alpha channel to the image channel mappings and metadata. If we then pass this image into the MAGN chunk type, we can see that at \[2\] we calculate the sizes for intermediate buffers next and prev, before calling GetAuthenticPixels at \[4\]. After the call at \[4\], the image-numchannels has increased to include the new alpha channel, and now length and the previously…

Published by the source

25 Aug 2025, 15:58 UTC

Last modified by the source

25 Aug 2025, 15:58 UTC

Source last checked

26 Oct 2026, 17:03 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-cjc8-g9w8-chfw

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2025-55004

Advisory: imagemagick: heap-buffer overflow read in MNG magnification with alpha
IDs: CVE-2025-55004, GHSA-cjc8-g9w8-chfw
Record: https://patchnext.com/advisories/cve-2025-55004 (revision 1, source checked 26 Oct 2026, 17:03 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 7.6)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: magick.net-q8-arm64 14.8.0; magick.net-q8-x86 14.8.0; magick.net-q16-hdri-anycpu 14.8.0; magick.net-q16-openmp-x64 14.8.0; magick.net-q16-anycpu 14.8.0; magick.net-q16-hdri-x86 14.8.0; magick.net-q16-hdri-openmp-arm64 14.8.0; magick.net-q16-hdri-arm64 14.8.0; magick.net-q16-x86 14.8.0; magick.net-q8-openmp-x64 14.8.0; magick.net-q16-hdri-openmp-x64 14.8.0; magick.net-q16-openmp-arm64 14.8.0; magick.net-q16-x64 14.8.0; magick.net-q8-x64 14.8.0; magick.net-q8-openmp-arm64 14.8.0; magick.net-q8-anycpu 14.8.0; magick.net-q16-arm64 14.8.0; magick.net-q16-hdri-x64 14.8.0. A vendor fix does not mean a deployment is fixed.

## Affected components
- NuGet magick.net-q8-arm64: affected < 14.8.0; fixed in 14.8.0
- NuGet magick.net-q8-x86: affected < 14.8.0; fixed in 14.8.0
- NuGet magick.net-q16-hdri-anycpu: affected < 14.8.0; fixed in 14.8.0
- NuGet magick.net-q16-openmp-x64: affected < 14.8.0; fixed in 14.8.0
- NuGet magick.net-q16-anycpu: affected < 14.8.0; fixed in 14.8.0
- NuGet magick.net-q16-hdri-x86: affected < 14.8.0; fixed in 14.8.0
- NuGet magick.net-q16-hdri-openmp-arm64: affected < 14.8.0; fixed in 14.8.0
- NuGet magick.net-q16-hdri-arm64: affected < 14.8.0; fixed in 14.8.0
- NuGet magick.net-q16-x86: affected < 14.8.0; fixed in 14.8.0
- NuGet magick.net-q8-openmp-x64: affected < 14.8.0; fixed in 14.8.0
- NuGet magick.net-q16-hdri-openmp-x64: affected < 14.8.0; fixed in 14.8.0
- NuGet magick.net-q16-openmp-arm64: affected < 14.8.0; fixed in 14.8.0
- NuGet magick.net-q16-x64: affected < 14.8.0; fixed in 14.8.0
- NuGet magick.net-q8-x64: affected < 14.8.0; fixed in 14.8.0
- NuGet magick.net-q8-openmp-arm64: affected < 14.8.0; fixed in 14.8.0
- NuGet magick.net-q8-anycpu: affected < 14.8.0; fixed in 14.8.0
- NuGet magick.net-q16-arm64: affected < 14.8.0; fixed in 14.8.0
- NuGet magick.net-q16-hdri-x64: affected < 14.8.0; fixed in 14.8.0

## Suggested inspection (read-only)
- NuGet magick.net-q8-arm64: check the installed version with your package manager.
- NuGet magick.net-q8-x86: check the installed version with your package manager.
- NuGet magick.net-q16-hdri-anycpu: check the installed version with your package manager.
- NuGet magick.net-q16-openmp-x64: check the installed version with your package manager.
- NuGet magick.net-q16-anycpu: check the installed version with your package manager.
- NuGet magick.net-q16-hdri-x86: check the installed version with your package manager.
- NuGet magick.net-q16-hdri-openmp-arm64: check the installed version with your package manager.
- NuGet magick.net-q16-hdri-arm64: check the installed version with your package manager.
- NuGet magick.net-q16-x86: check the installed version with your package manager.
- NuGet magick.net-q8-openmp-x64: check the installed version with your package manager.
- NuGet magick.net-q16-hdri-openmp-x64: check the installed version with your package manager.
- NuGet magick.net-q16-openmp-arm64: check the installed version with your package manager.
- NuGet magick.net-q16-x64: check the installed version with your package manager.
- NuGet magick.net-q8-x64: check the installed version with your package manager.
- NuGet magick.net-q8-openmp-arm64: check the installed version with your package manager.
- NuGet magick.net-q8-anycpu: check the installed version with your package manager.
- NuGet magick.net-q16-arm64: check the installed version with your package manager.
- NuGet magick.net-q16-hdri-x64: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on magick.net-q8-arm64, magick.net-q8-x86, magick.net-q16-hdri-anycpu, magick.net-q16-openmp-x64, magick.net-q16-anycpu, magick.net-q16-hdri-x86, magick.net-q16-hdri-openmp-arm64, magick.net-q16-hdri-arm64, magick.net-q16-x86, magick.net-q8-openmp-x64, magick.net-q16-hdri-openmp-x64, magick.net-q16-openmp-arm64, magick.net-q16-x64, magick.net-q8-x64, magick.net-q8-openmp-arm64, magick.net-q8-anycpu, magick.net-q16-arm64, magick.net-q16-hdri-x64.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-cjc8-g9w8-chfw (GitHub-reviewed advisory GHSA-cjc8-g9w8-chfw lists affected ranges: NuGet magick.net-q16-anycpu >=0 =0 =0 =0 =0 =0 =0 =0 =0 <14.8.0; NuGet…)

Commands are suggestions: review each one before running it.