CVE-2025-53015 is a high-severity (CVSS 7.5) CWE-835 vulnerability in Magick.NET-Q8-AnyCPU. A fix is available for Magick.NET-Q8-AnyCPU — see the affected versions and patch details below.
ImageMagick has XMP profile write that triggers hang due to unbounded loop
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
Exploitation and automatability from CISA’s SSVC triage for CVE-2025-53015.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
Magick.NET-Q8-AnyCPU.NETMagick.NET-Q16-AnyCPU.NETMagick.NET-Q16-HDRI-AnyCPU.NETMagick.NET-Q8-x64.NETMagick.NET-Q8-arm64.NETMagick.NET-Q8-x86.NETMagick.NET-Q8-OpenMP-x64.NETMagick.NET-Q8-OpenMP-arm64+11 moreReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects NuGet packages — download data is not available via public APIs for these ecosystems.
Description
Summary
Infinite lines occur when writing during a specific XMP file conversion command
Details
#0 GetXmpNumeratorAndDenominator (denominator=<optimized out>, numerator=<optimized out>, value=<optimized out>) at MagickCore/profile.c:2578
#1 GetXmpNumeratorAndDenominator (denominator=<synthetic pointer>, numerator=<synthetic pointer>, value=720000000000000) at MagickCore/profile.c:2564
#2 SyncXmpProfile (image=image@entry=0x555555bb9ea0, profile=0x555555b9d020) at MagickCore/profile.c:2605
#3 0x00005555555db5cf in SyncImageProfiles (image=image@entry=0x555555bb9ea0) at MagickCore/profile.c:2651
#4 0x0000555555798d4f in WriteImage (image_info=image_info@entry=0x555555bc2050, image=image@entry=0x555555bb9ea0, exception=exception@entry=0x555555b7bea0) at MagickCore/constitute.c:1288
#5 0x0000555555799862 in WriteImages (image_info=image_info@entry=0x555555bb69c0, images=<optimized out>, images@entry=0x555555bb9ea0, filename=<optimized out>, exception=0x555555b7bea0) at MagickCore/constitute.c:1575
#6 0x00005555559650c4 in CLINoImageOperator (cli_wand=cli_wand@entry=0x555555b85790, option=option@entry=0x5555559beebe "-write", arg1n=arg1n@entry=0x7fffffffe2c7 "a.mng", arg2n=arg2n@entry=0x0) at MagickWand/operation.c:4993
#7 0x0000555555974579 in CLIOption (cli_wand=cli_wand@entry=0x555555b85790, option=option@entry=0x5555559beebe "-write") at MagickWand/operation.c:5473
#8 0x00005555559224aa in ProcessCommandOptions (cli_wand=cli_wand@entry=0x555555b85790, argc=argc@entry=3, argv=argv@entry=0x7fffffffdfa8, index=index@entry=1) at MagickWand/magick-cli.c:758
#9 0x000055555592276d in MagickImageCommand (image_info=image_info@entry=0x555555b824a0, argc=argc@entry=3, argv=argv@entry=0x7fffffffdfa8, metadata=metadata@entry=0x7fffffffbc10, exception=exception@entry=0x555555b7bea0) at MagickWand/magick-cli.c:1392
#10 0x00005555559216a0 in MagickCommandGenesis (image_info=image_info@entry=0x555555b824a0, command=command@entry=0x555555922640 <MagickImageCommand>, argc=argc@entry=3, argv=argv@entry=0x7fffffffdfa8, metadata=0x0, exception=exception@entry=0x555555b7bea0) at MagickWand/magick-cli.c:177
#11 0x000055555559f76b in MagickMain (argc=3, argv=0x7fffffffdfa8) at utilities/magick.c:162
#12 0x00007ffff700fd90 in __libc_start_call_main (main=main@entry=0x55555559aec0 <main>, argc=argc@entry=3, argv=argv@entry=0x7fffffffdfa8) at ../sysdeps/nptl/libc_start_call_main.h:58
#13 0x00007ffff700fe40 in __libc_start_main_impl (main=0x55555559aec0 <main>, argc=3, argv=0x7fffffffdfa8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdf98) at ../csu/libc-start.c:392
#14 0x000055555559f535 in _start ()
static void GetXmpNumeratorAndDenominator(double value,
unsigned long *numerator,unsigned long *denominator)
{
double
df;
*numerator=0;
*denominator=1;
if (value <= MagickEpsilon)
return;
*numerator=1;
df=1.0;
while(fabs(df - value) > MagickEpsilon)
{
if (df < value)
(*numerator)++;
else
{
(*denominator)++;
*numerator=(unsigned long) (value*(*denominator));
}
df=*numerator/(double)*denominator;
}
}
In this code, the loop while(fabs(df - value) > MagickEpsilon) keeps repeating endlessly.
PoC
magick hang a.mng
https://drive.google.com/file/d/1iegkwlTjqnJTtM4XkiheYsjKsC6pxtId/view?usp=sharing
Impact
XMP profile write triggers hang due to unbounded loop
credits
Team Pay1oad DVE
Reporter : Shinyoung Won (with contributions from WooJin Park, DongHa Lee, JungWoo Park, Woojin Jeon, Juwon Chae, Kyusang Han, JaeHun Gou)
yosimich(@yosiimich) Shinyoung Won of SSA Lab
e-mail : [[email protected]]
Woojin Jeon
Gtihub : brainoverflow
e-mail : [[email protected]]
WooJin Park
GitHub : jin-156
e-mail : [[email protected]]
Who4mI(@GAP-dev) Lee DongHa of SSA Lab
Github: GAP-dev
e-mail : [[email protected]]
JungWoo Park
Github : JungWooJJING
e-mail : [[email protected]]
Juwon Chae
Github : I_mho
e-mail : [[email protected]]
Kyusang Han
Github : T1deSEC
e-mail : [[email protected]]
JaeHun Gou
Github : P2GONE
e-mail : [[email protected]]
Commits
Fixed in: https://github.com/ImageMagick/ImageMagick/commit/229fa96a988a21d78318bbca61245a6ed1ee33a0 and https://github.com/ImageMagick/ImageMagick/commit/38631605e6ab744548a561797472cf8648bcfe26
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| .NETNuGet | Magick.NET-Q8-AnyCPU | all versions | 14.7.0dotnet add package Magick.NET-Q8-AnyCPU --version 14.7.0 |
| .NETNuGet | Magick.NET-Q16-AnyCPU | all versions | 14.7.0dotnet add package Magick.NET-Q16-AnyCPU --version 14.7.0 |
| .NETNuGet | Magick.NET-Q16-HDRI-AnyCPU | all versions | 14.7.0dotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.7.0 |
| .NETNuGet | Magick.NET-Q8-x64 | all versions | 14.7.0dotnet add package Magick.NET-Q8-x64 --version 14.7.0 |
| .NETNuGet | Magick.NET-Q8-arm64 | all versions | 14.7.0dotnet add package Magick.NET-Q8-arm64 --version 14.7.0 |
| .NETNuGet | Magick.NET-Q8-x86 | all versions | 14.7.0dotnet add package Magick.NET-Q8-x86 --version 14.7.0 |
Affected Products
imagemagickimagemagickDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Magick.NET-Q8-AnyCPU, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update Magick.NET-Q8-AnyCPU to 14.7.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-53015 is resolved across your whole dependency graph.
Workarounds
Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.Source: Red Hat security advisory for CVE-2025-53015 (CC BY 4.0)
Frequently Asked Questions
Is CVE-2025-53015 in your dependencies?
Find it across NuGet, including transitive dependencies.