CVE-2025-53101

What it actually does

Multiple consecutive %d format specifiers in a filename template for the magick mogrify command trigger incorrect pointer arithmetic that computes an address below the stack buffer base, leading to a stack-based buffer overflow during vsnprintf processing.

Why it matters to the business

Organizations relying on ImageMagick for batch image processing or automated pipelines risk application crashes or potential remote code execution when processing untrusted filename templates, which can disrupt media workflows and require emergency patching across development and production environments.

How an attack unfolds

An attacker supplies a crafted filename containing repeated %d specifiers to the mogrify command; the resulting pointer underflow during format string expansion allows vsnprintf to write beyond the intended stack buffer, enabling stack corruption that may be leveraged for code execution in the context of the ImageMagick process.

How to fix it

Upgrade ImageMagick to version 7.1.2-0 or later and 6.9.13-26 or later; for GIT builds apply commits 3fcd081c0278427fc0e8ac40ef75c0a1537792f7 for imagemagick and 363f86d818f807e49269287be9c326f658379685 for imagemagick6; rebuild any dependent packages and test image-processing pipelines with the updated binaries.

How to confirm the fix worked

Verify installed versions report 7.1.2-0 or newer and 6.9.13-26 or newer; execute mogrify with a test template containing repeated %d specifiers and confirm absence of crashes or unexpected memory access; review build logs for the referenced GIT commits.

Typical attack path

1. Locate an ImageMagick installation using versions prior to the fixed commits
2. Prepare a filename template containing multiple consecutive %d specifiers
3. Invoke magick mogrify with the malicious template on a target image
4. Trigger the pointer arithmetic error to overflow the stack buffer via vsnprintf
5. Attempt to control execution flow through the resulting stack corruption

How to detect it

Review process execution logs and command-line histories for invocations of mogrify or convert containing repeated percent-d sequences; inspect core dumps or crash reports from ImageMagick processes; correlate with file-creation events involving templates that include multiple %d placeholders.

• mogrify.*%d.*%d
• convert.*%d.*%d.*%d
• vsnprintf stack underflow
• ImageMagick.*pointer arithmetic

What your security team should do

• Prioritize immediate upgrade of all ImageMagick instances to the fixed versions or commits
• Scan build and CI systems for references to vulnerable GIT revisions and enforce version pinning
• Monitor EPSS trend and re-evaluate exposure if exploit maturity increases
• Restrict use of mogrify on untrusted filename inputs until patches are deployed