sumitshah00/cve-2025-66628Technical analysis of CVE-2025-66628, an integer overflow in ImageMagick's TIM parser leading to out-of-bounds reads, with root cause, exploitation steps, and remediation guidance.
| Attribute | Details |
|---|
| CVE ID | CVE-2025-66628 |
| Vendor | ImageMagick Studio LLC |
| Product | ImageMagick |
| Affected Versions | < 7.1.2-10 |
| Fixed Version | 7.1.2-10 |
| Vulnerability Type | CWE-190 (Integer Overflow) |
| CVSS v3.1 Score | 7.5 (High) |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| Researcher | Sumit Shah |
An integer overflow vulnerability exists in the ReadTIMImage function within coders/tim.c of ImageMagick. When processing TIM (PlayStation) image files on 32-bit systems, unchecked multiplication of user-controlled width and height values results in memory under-allocation, leading to out-of-bounds reads during pixel processing.
The vulnerable logic resides in coders/tim.c:
/* coders/tim.c - TIM Image Parser */
// User-controlled input from TIM file header
width = ReadBlobLSBShort(image); // 2 bytes (0-65535)
height = ReadBlobLSBShort(image); // 2 bytes (0-65535)
// VULNERABLE: Integer overflow on 32-bit systems
image_size = 2 * width * height; // No overflow check
// Memory allocated with truncated size
pixels = (unsigned char *) AcquireQuantumMemory(image_size, sizeof(*pixels));
// Loop processes FULL dimensions, reading beyond buffer
for (y = 0; y < height; y++) {
for (x = 0; x < width; x++) {
pixel_index = (y * width + x) * 2;
pixels[pixel_index] = ReadBlobByte(image);
pixels[pixel_index + 1] = ReadBlobByte(image);
}
}
On 32-bit architectures, size_t is limited to 32 bits with maximum value UINT_MAX = 4,294,967,295.
When width and height are both set to maximum 16-bit unsigned values:
width = 65535 (0xFFFF)
height = 65535 (0xFFFF)
Expected calculation:
2 × 65535 × 65535 = 8,589,869,050 bytes (~8.5 GB)
Actual result (32-bit wraparound):
8,589,869,050 % 4,294,967,296 = 4,294,901,754
Result after truncation: Small allocated buffer
The overflow causes the memory allocator to reserve a drastically smaller buffer than required, while the processing loop still iterates over the full 65535 × 65535 pixel grid, resulting in out-of-bounds reads.
Step 1: Attacker crafts TIM file with dimensions causing overflow
[Magic: 0x10]
[Type: 0x02]
[Width: 0xFFFF] # 65535
[Height: 0xFFFF] # 65535
[Pixel Data...]
Step 2: Victim processes the malicious file
convert malicious.tim output.png
Step 3: Out-of-bounds read occurs, leading to:
32-bit systems where size_t is 32-bit. 64-bit systems are not affected due to sufficient integer width to represent the calculated size without overflow.
Information Disclosure (Primary): Heap memory from the ImageMagick process can be read during the out-of-bounds access. This memory may contain:
The leaked data can be embedded in the converted output image or extracted via side-channel analysis.
Denial of Service (Secondary):
Reading unmapped memory regions triggers SIGSEGV, causing ImageMagick process termination and service disruption in automated image processing pipelines.
Technical details are provided for validation purposes. No executable exploit code is distributed.
convert, magick, or any ImageMagick API call$ convert malicious.tim output.png
Segmentation fault (core dumped)
Or successful conversion with leaked heap data embedded in output.
$ convert malicious.tim output.png
convert: Memory allocation failed `malicious.tim' @ error/tim.c/ReadTIMImage/XXX.
Update ImageMagick to version 7.1.2-10 or later:
# Verify current version
convert --version
# Update using package manager
apt update && apt upgrade imagemagick # Debian/Ubuntu
yum update imagemagick # RHEL/CentOS
brew upgrade imagemagick # macOS
Implement overflow checking before arithmetic operations:
// Insecure
image_size = 2 * width * height;
// Secure
if (height != 0 && width > (SIZE_MAX / 2) / height) {
ThrowReaderException(ResourceLimitError, "MemoryAllocationFailed");
}
image_size = 2 * width * height;
Apply input validation and sanity limits on dimension values before performing calculations.
This vulnerability was identified using variant analysis. Following disclosure of a similar integer overflow in ImageMagick's BMP decoder, a systematic review of legacy format parsers was conducted. Pattern matching for unchecked width * height calculations led to identification of the same flaw in the TIM parser.
Legacy image format decoders (TIM, SGI, VIFF, etc.) represent high-value targets due to infrequent security audits and reliance on unsafe C arithmetic.
This vulnerability was reported privately to ImageMagick maintainers via GitHub Security Advisories. Public disclosure occurred only after patch availability and CVE assignment. This research was conducted ethically under responsible disclosure principles.
SUMIT SHAH
Researcher: SUMIT SHAH