Описание
ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crash
Summary
Passing a geometry string containing only a colon (":") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service.
Details
Root Cause
montage -geometry ":" ...reachesMagickCore/geometry.c:GetGeometry().StringToDouble/InterpretLocaleValueparses":"as0.0;then: https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355WidthValue(and/orHeightValue)is set with a zero dimension.- In MagickCore/resize.c:ThumbnailImage(), the code computes: https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629 causing a division by zero and immediate crash.
The issue is trivially triggerable without external input files (e.g., using xc:white).
Reproduction
Environment
Steps
Observed result
PoC
No external file required; the pseudo image xc:white suffices:
Impact
- Denial of Service: A divide-by-zero in
ThumbnailImage()causes immediate abnormal termination (e.g., SIGFPE/abort), crashing the ImageMagick process.
Suggested fix
Defensively reject zero dimensions early in ThumbnailImage():
Additionally, consider tightening validation in GetGeometry() so that colon-only (and similar malformed) inputs do not yield WidthValue/HeightValue with zero, or are rejected outright. Variants like "x:" or ":x" may also need explicit handling (maintainer confirmation requested).
Credits
Team Daemon Fuzz Hunters
Bug Hunting Master Program, HSpace/Findthegap
Woojin Park @jin-156 1203kids@gmail.com
Hojun Lee @leehohojune leehojune@korea.ac.kr
Youngin Won @amethyst0225 youngin04@korea.ac.kr
Siyeon Han @hanbunny kokosyeon@gmail.com
Ссылки
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fh55-q5pj-pxgw
- https://nvd.nist.gov/vuln/detail/CVE-2025-55212
- https://github.com/ImageMagick/ImageMagick/commit/5f0bcf986b8b5e90567750d31a37af502b73f2af
- https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355
- https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629
- https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1
- https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html
Пакеты
Magick.NET-Q16-AnyCPU
< 14.8.1
14.8.1
Magick.NET-Q16-HDRI-AnyCPU
< 14.8.1
14.8.1
Magick.NET-Q16-HDRI-OpenMP-arm64
< 14.8.1
14.8.1
Magick.NET-Q16-HDRI-OpenMP-x64
< 14.8.1
14.8.1
Magick.NET-Q16-HDRI-arm64
< 14.8.1
14.8.1
Magick.NET-Q16-HDRI-x64
< 14.8.1
14.8.1
Magick.NET-Q16-HDRI-x86
< 14.8.1
14.8.1
Magick.NET-Q16-OpenMP-arm64
< 14.8.1
14.8.1
Magick.NET-Q16-OpenMP-x64
< 14.8.1
14.8.1
Magick.NET-Q16-arm64
< 14.8.1
14.8.1
Magick.NET-Q16-x64
< 14.8.1
14.8.1
Magick.NET-Q16-x86
< 14.8.1
14.8.1
Magick.NET-Q8-AnyCPU
< 14.8.1
14.8.1
Magick.NET-Q8-OpenMP-arm64
< 14.8.1
14.8.1
Magick.NET-Q8-OpenMP-x64
< 14.8.1
14.8.1
Magick.NET-Q8-arm64
< 14.8.1
14.8.1
Magick.NET-Q8-x64
< 14.8.1
14.8.1
Magick.NET-Q8-x86
< 14.8.1
14.8.1
Связанные уязвимости
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (":") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (":") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (":") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.
ImageMagick is free and open-source software used for editing and mani ...
Уязвимость функции ThumbnailImage() консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании