CVE-2025-57803 Details

A heap buffer overflow vulnerability has been identified in ImageMagick's BMP encoder, specifically in 32-bit builds prior to versions 6.9.13-28 and 7.1.2-2. The issue arises from a 32-bit integer overflow in the scanline-stride computation for 24-bits per pixel images. This overflow causes the 'bytes_per_line' (stride) to collapse to a very small value, while the encoder still writes 3 times the image width in bytes. As a result, the first row of the image overwrites its allocated space and encroaches into adjacent heap memory, using bytes controlled by the attacker. This vulnerability creates a classic heap corruption scenario, particularly in automated image processing pipelines that convert or generate thumbnails.

Users should update to ImageMagick versions 6.9.13-28 or 7.1.2-2. For those using the C/C++ library, ensure that the version is 7.1.2-2 or later.