CVE-2025-55298

A flaw was found in ImageMagick. Processing a file with a specially crafted name, specifically one with format specifiers such as %d, %o, or %x, can trigger a format string bug due to improper input sanitization, resulting in a heap-based buffer over-read or arbitrary code execution.

This issue can cause a heap-based buffer over-read or arbitrary code execution via a crafted filename. However, default Red Hat Enterprise Linux security features such as SELinux enforcement, Address Space Layout Randomization (ASLR) and memory protections reduce the possibility of exploitation, limiting the impact to a denial of service.

Additionally, ImageMagick is not shipped in Red Hat Enterprise Linux 8, 9 and 10. Therefore, these versions are not affected by this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To prevent unintended interpretation of the filename as a format string, users can explicitly disable format string parsing by defining the filename as a literal. This can be done using the following directive:

In wrappers: filename:literal From the command line: -define filename:literal=true