Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
ImageMagick (WriteBMPImage) versions before 14.8.1 are affected when Magick.NET packages are used; this record lists the Magick.NET NuGet packages, with fixes in 14.8.1 for all six variants. On 32-bit builds, an integer overflow in the BMP scanline stride calculation can cause a heap buffer overflow when converting an attacker-supplied image to BMP. The source gives few details on the attacker's requirements beyond supplying an image for conversion. Upgrade the affected Magick.NET packages to version 14.8.1 or later; no other workaround is listed.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.5 | High | 3.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0091, the 60th percentile, on 10 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 15:22 UTC First seen by agentprime
- 31 Oct 2026, 15:22 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-mxvv-97wh-cfmm
- OSV: GHSA-mxvv-97wh-cfmm
- github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mxvv-97wh-cfmm
- nvd.nist.gov/vuln/detail/CVE-2025-57803
- github.com/ImageMagick/ImageMagick/commit/2c55221f4d38193adcb51056c14cf238fbcc35d7
- github.com/ImageMagick/ImageMagick
- github.com/dlemstra/Magick.NET/releases/tag/14.8.1
- lists.debian.org/debian-lts-announce/2025/09/msg00012.html