CVE-2025-65955

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-9 ImageMagick versions prior to 6.9.13-34

Description ImageMagick is software used for editing and manipulating digital images. A flaw exists in the Magick++ layer when the Options::fontFamily function is called with an empty string. This can lead to memory being freed while a pointer still references it, resulting in crashes or heap corruption during cleanup or reuse. Specifically, calling RelinquishMagickMemory on drawInfo->font frees the font string, but drawInfo->font continues to point to the freed memory while drawInfo->family is set to that invalid pointer. Functions like DestroyDrawInfo, Options::font, and Image::font assume drawInfo->font remains valid, and their use can trigger crashes or heap corruption.

Recommendations Update ImageMagick to version 7.1.2-9 or later. Update ImageMagick to version 6.9.13-34 or later.