CVE-2025-43965

What it actually does

Mishandling of image depth after SetQuantumFormat in MIFF processing leads to improper input validation and potential memory corruption or incorrect quantum format handling during image decode.

Why it matters to the business

Applications that process MIFF images may crash, produce corrupted output, or become unstable when handling untrusted files, increasing operational risk for image-heavy workflows.

How an attack unfolds

An attacker crafts a malicious MIFF image that triggers depth mishandling after SetQuantumFormat, causing the library to enter an invalid state during decoding.

How to fix it

Upgrade ImageMagick to a build containing commit bac413a26073923d3ffb258adaab07fb3fe8fdc9 or later equivalent release that corrects MIFF depth handling after SetQuantumFormat.

How to confirm the fix worked

Confirm the installed version includes the referenced commit or is at least 7.1.1-44; test processing of known-good and edge-case MIFF files to verify stable depth handling.

Typical attack path

1. Attacker crafts a specially formatted MIFF file exploiting depth mishandling post-SetQuantumFormat
2. Victim application loads the image using vulnerable ImageMagick
3. Library processes the quantum format incorrectly leading to invalid state or corruption
4. Resulting behavior may cause crash, denial of service, or unexpected image output

How to detect it

Review application logs for ImageMagick crashes or errors during MIFF decoding; inspect process memory dumps or core files for quantum format anomalies after MIFF processing.

What your security team should do

• Prioritize upgrade of ImageMagick to the fixed commit across all build and runtime environments
• Restrict processing of untrusted MIFF files until patched
• Monitor for any downstream dependents that embed the vulnerable library