CVE-2025-55212

What it actually does

A geometry string consisting only of a colon causes GetGeometry() to set image width and height to zero; subsequent division by these zero values in ThumbnailImage() during montage processing triggers SIGFPE and abort.

Why it matters to the business

Attackers can remotely crash image-processing services that invoke montage, interrupting automated workflows that rely on ImageMagick for thumbnail generation or batch operations.

How an attack unfolds

An attacker passes the literal string ":" as the argument to the -geometry option of the montage command; the malformed input reaches the vulnerable geometry parser and later triggers the division-by-zero crash in thumbnail generation.

How to fix it

Upgrade to ImageMagick 6.9.13-28, 7.1.2-2 or newer; for GIT builds apply commit 5f0bcf986b8b5e90567750d31a37af502b73f2af.

How to confirm the fix worked

Execute 'montage -geometry : input.jpg out.jpg' on a patched build and confirm the command completes without SIGFPE; verify installed version reports 6.9.13-28 or 7.1.2-2 or later.

Typical attack path

1. Locate an application or script that invokes ImageMagick montage with attacker-controlled geometry parameters
2. Supply a geometry value consisting solely of the colon character
3. Trigger execution of montage to reach GetGeometry() followed by ThumbnailImage() and induce the crash

How to detect it

Search process and system logs for abrupt termination of the montage binary accompanied by SIGFPE or abort signals; correlate with command-line arguments containing only a colon in the geometry field.

What your security team should do

• Apply the listed fixed versions or commit to all ImageMagick installations
• Review and sanitize any code paths that pass user input directly to montage -geometry
• Add monitoring for ImageMagick process crashes with floating-point exceptions