{"id":"CVE-2025-55160","aliases":["GHSA-6hgw-6x87-578x"],"url":"https://o3.security/vulnerability/CVE-2025-55160","summary":"ImageMagick Undefined Behavior (function-type-mismatch) in CloneSplayTree","details":"## Summary\n- **Target:** ImageMagick (commit `ecc9a5eb456747374bae8e07038ba10b3d8821b3`)\n- **Type:** Undefined Behavior (function-type-mismatch) in splay tree cloning callback\n- **Impact:** Deterministic abort under UBSan (DoS in sanitizer builds). No crash in a non-sanitized build; likely low security impact.\n- **Trigger:** Minimal **2-byte** input parsed via MagickWand, then coalescing.\n## Environment\nOS: macOS (Apple Silicon/arm64)\nHomebrew clang version 20.1.8\nTarget: arm64-apple-darwin24.5.0\nThread model: posix\nInstalledDir: /opt/homebrew/Cellar/llvm/20.1.8/bin\nConfiguration file: /opt/homebrew/etc/clang/arm64-apple-darwin24.cfg\nHomebrew ImageMagick: `magick -version` → `ImageMagick 7.1.2-0 Q16-HDRI aarch64`\npkg-config: `MagickWand-7.Q16HDRI` version `7.1.2`\nLibrary configure flags (capsule build):\n./configure --disable-shared --enable-static --without-modules --without-magick-plus-plus --disable-openmp --without-perl --without-x --with-png=yes --without-jpeg --without-tiff --without-xml --without-lqr --without-gslib\nHarness compile flags:\n-fsanitize=fuzzer,address,undefined -fno-omit-frame-pointer\npkg-config cflags/libs supplied:\n-I<...>/include/ImageMagick-7\n-DMAGICKCORE_HDRI_ENABLE=1 -DMAGICKCORE_QUANTUM_DEPTH=16 -DMAGICKCORE_CHANNEL_MASK_DEPTH=32\nand linked against MagickWand-7.Q16HDRI and MagickCore-7.Q16HDRI\nSanitizer runtime:\nASan+UBSan defaults. Repro also with `UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1`\n## PoC\n- **Bytes (hex):** `1c 02`\n- **Base64:** `HAI=`\n - **sha256 (optional):** <fill in>\n## Reproduction\nCreate PoC:\n\n`printf '\\x1c\\x02' > poc.bin`\n\nOption A: libFuzzer harness\n- Run once: `./harness_ImageMagick_... -runs=1 ./poc.bin`\n- Expected: UBSan aborts with function-type-mismatch at `MagickCore/splay-tree.c:372:43`.\n\nOption B: standalone reproducer (C)\n- Compile (ensure `PKG_CONFIG_PATH` points to your ImageMagick if needed):\n\n/opt/homebrew/opt/llvm/bin/clang -g -O1 -fsanitize=address,undefined $(/opt/homebrew/bin/pkg-config --cflags MagickWand-7.Q16HDRI) repro.c -o repro $(/opt/homebrew/bin/pkg-config --libs MagickWand-7.Q16HDRI)\n\n- Run:\n\nUBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1 ./repro ./poc.bin\nObserved output (excerpt)\nMagickCore/splay-tree.c:372:43: runtime error: call to function ConstantString through pointer to incorrect function type 'void *(*)(void *)'\nstring.c:680: note: ConstantString defined here\n#0 CloneSplayTree splay-tree.c:372\n#1 CloneImageProfiles profile.c:159\n#2 CloneImage image.c:832\n#3 CoalesceImages layer.c:269\n#4 MagickCoalesceImages magick-image.c:1665\n#5 main repro.c:XX\nRoot cause\nThe splay tree clone callback expects a function pointer of type `void *(*)(void *)`. ConstantString has a different signature (`char *ConstantString(const char *)`). Calling through the mismatched function type is undefined behavior in C and triggers UBSan’s function-type-mismatch.\nThe path is exercised during coalescing: CloneImage → CloneImageProfiles → CloneSplayTree.\nScope\nReproduces with a minimal, sanitizer-instrumented, PNG-enabled build and delegates disabled (policy.xml), suggesting the issue is in MagickCore rather than external delegates.\nSuggested fix (sketch)\nUse a wrapper that matches the expected callback prototype, or adjust the splay-tree callback typedef for const-correctness. For example:\nstatic void *CloneStringShim(const void *p) {\nreturn (void *) ConstantString((const char *) p);\n}\n\n/* When setting splay-tree clone_value, use CloneStringShim instead of ConstantString. */\n\nAlternatively, update the clone callback typedefs to use const void* consistently (and return void*) and ensure callers pass a correctly typed wrapper.\n\nArtifacts\nMinimised PoC: attached (poc.bin, 2 bytes; base64 HAI=)\nHarness source and exact build command (attached)\nFull UBSan trace (attached)\nCommit SHA and configure flags (above)\nCredits\nDiscovered by: Lumina Mescuwa\nMethod: libFuzzer + UBSan\nVerification\n- UBSan build: Reproduces with `halt_on_error=1`; aborts at `MagickCore/splay-tree.c:372`.\n- Non-sanitized Homebrew build (macOS arm64, clang 20.1.8): No crash; repro completes silently.","published":"2025-08-13T14:00:53.826Z","modified":"2026-08-12T03:51:08.425610192Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"Magick.NET-Q16-AnyCPU","fixedVersion":"14.8.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-HDRI-AnyCPU","fixedVersion":"14.8.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-HDRI-OpenMP-arm64","fixedVersion":"14.8.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-HDRI-OpenMP-x64","fixedVersion":"14.8.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-HDRI-arm64","fixedVersion":"14.8.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-HDRI-x64","fixedVersion":"14.8.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-HDRI-x86","fixedVersion":"14.8.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-OpenMP-arm64","fixedVersion":"14.8.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-OpenMP-x64","fixedVersion":"14.8.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-arm64","fixedVersion":"14.8.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-x64","fixedVersion":"14.8.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-x86","fixedVersion":"14.8.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q8-AnyCPU","fixedVersion":"14.8.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q8-OpenMP-arm64","fixedVersion":"14.8.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q8-OpenMP-x64","fixedVersion":"14.8.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q8-arm64","fixedVersion":"14.8.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q8-x64","fixedVersion":"14.8.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q8-x86","fixedVersion":"14.8.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55160.json"},{"type":"ADVISORY","url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hgw-6x87-578x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55160"},{"type":"PACKAGE","url":"https://github.com/ImageMagick/ImageMagick"},{"type":"WEB","url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.8.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:08.425610192Z"}}