A proof-of-concept (PoC) exploit for a critical remote code execution (RCE) vulnerability in the MagickCore of ImageMagick 7.The vulnerability specifically affects the blob I/O (BlobStream) implementation.
Security researchers and the ImageMagick team urge all users and organizations to immediately update to prevent a potential exploit.
ImageMagick, a widely used image processing library, was found to contain a “ heap out-of-bounds write ” bug in the SeekBlob() and WriteBlob() functions in the MagickCore/blob.c component.
This vulnerability, tracked as CVE-2025-57807 and rated CVSS 9.8 (Critical), allows attackers to corrupt memory and execute arbitrary code under certain conditions.
See also: Warning: Critical vulnerability in Apache Jackrabbit
The bug lies in the handling of forward seeks on memory-backed blobs. The root of the problem is a contract mismatch between SeekBlob() and WriteBlob().
The security issue affects ImageMagick versions 7.1.2-0 and 7.1.2-1 (and possibly other versions with similar logic) and is architecture-agnostic on LP64 systems.
ImageMagick: Functional PoC exploit
Security researcher Lumina Mescuwa has released a working proof-of-concept exploit that demonstrates memory corruption after a forward seek well past the end of the buffer, followed by a write. This provides an attacker with a powerful advantage for remote code execution, as heap corruption can be exploited for process takeover or denial of service attacks.
Given the use of ImageMagick in web services and cloud infrastructure, unsanitized workloads could allow attackers to execute code remotely simply by uploading a crafted image. Organizations that use ImageMagick for image management are at high risk if external images are processed without strict isolation.
Security updates
The ImageMagick project has released updates that close this vulnerability: 7.1.2-3 (7.x) and 6.9.13-29 (6.x).
All users must:
– Upgrade ImageMagick to the latest versions immediately.
– Check deployments and ensure there are no old versions in production.
– Consider hardening downstream processing to detect suspicious file searches and writes.
See also: How Microsoft Azure Storage Logs help with security breach investigation
Security teams worldwide are monitoring for exploit attempts. With the release of a public PoC exploit, immediate action is essential for all ImageMagick-based environments.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Risk for thousands of users
The ImageMagick case clearly shows how dangerous the open source ecosystem can become when a library, almost “invisible” to the end user, is the foundation of millions of applications. The problem is not just the existence of a high-severity bug; it is that ImageMagick is silently used in social networking platforms, CMS, cloud services, and even in software running on corporate servers. When an attacker can trigger remote code execution with an image ― the most innocent, seemingly harmless payload ― the issue takes on enormous proportions.
The fact that a PoC exploit has been publicly released accelerates the risk, because no special expertise is needed to attempt an attack. The vulnerability is almost “commoditized”, so any malicious actor can exploit it. For organizations that rely on automated pipelines (e.g. platforms that process thousands of images per day), the likelihood of a breach increases exponentially.
See also: Critical vulnerability in Argo CD API exposes repository credentials
From a business perspective, such incidents highlight the need for defense-in-depth. Simply upgrading to the latest version is not enough; there must be mechanisms for sandboxing, privilege restriction, and continuous monitoring of application behavior. In addition, it highlights the responsibility of DevOps teams to actively manage third-party libraries, rather than taking them for granted.
CVE-2025-57807 is not just “another” critical vulnerability. It is a reminder that an organization’s attack surface is not limited to core systems, but includes every dependency, no matter how small. Negligence in such cases can lead to anything from data leakage to complete infrastructure collapse. In an environment where attacks are constantly escalating, speed of response is as critical as the fix itself.
