PoC Exploit for ImageMagick RCE Vulnerability Now Available – Update Your Systems Immediately!
A proof-of-concept (PoC) exploit has been released for a critical remote code execution (RCE) vulnerability in ImageMagick 7’s MagickCore subsystem, specifically affecting the blob I/O (BlobStream) implementation. Security researchers and the ImageMagick team urge all users and organisations to update immediately to prevent exploitation. ImageMagick, a widely used image processing library, contains a heap out-of-bounds write flaw in its SeekBlob() and WriteBlob() functions within the MagickCore/blob.c component. This vulnerability, tracked as CVE-2025-57807 and rated CVSS 9.8 (Critical), allows attackers to corrupt memory and reliably execute arbitrary code under certain conditions. The flaw arises from the handling of forward seeks in memory-backed blobs, where seeking beyond the end of the buffer permits subsequent writes to overrun the buffer and corrupt the heap, with attacker-controlled data written at chosen offsets.
The root cause of this vulnerability is a contract mismatch between SeekBlob() and WriteBlob(), which leads to reliable exploits when a forward seek is performed prior to writing data. The issue affects ImageMagick versions 7.1.2-0 and 7.1.2-1, and potentially other versions with similar logic, being architecture-agnostic on LP64 systems. The easy reachability of the bug means that even third-party or custom encode-to-memory workflows may inadvertently introduce exploit paths. Security researcher Lumina Mescuwa has demonstrated a working PoC exploit that showcases memory corruption following a forward seek well past the buffer’s end, followed by a write. This vulnerability provides attackers with a strong primitive for remote code execution, as heap corruption can be leveraged for process takeover or denial of service. Given ImageMagick’s extensive use in web services and cloud pipelines, unsanitised workloads may allow attackers to execute code remotely by simply uploading a crafted image. Organisations using ImageMagick for image handling are at high risk if external images are processed without strict isolation. The ImageMagick project has released patches to close this vulnerability, with versions 7.1.2-3 (7.x) and 6.9.13-29 (6.x) being the first safe releases. The fix ensures that all writes are preceded by buffer expansion to meet the actual offset plus length, thereby eliminating the out-of-bounds write. All users are advised to upgrade ImageMagick immediately to the patched versions, audit deployments to ensure no legacy builds remain in production, and consider hardening downstream processing to detect suspicious seeks and file writes. Security teams worldwide are actively monitoring for exploit attempts, making prompt action essential for all environments.
Categories: Vulnerability, Exploit, Mitigation
Tags: ImageMagick, Remote Code Execution, Vulnerability, CVE-2025-57807, Heap Corruption, Proof-of-Concept, Blob I/O, Security Patches, Exploit, Memory Management