3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-55212

CVE-2025-55212: ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crash

Summary

Passing a geometry string containing only a colon (":") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service.

Details

Root Cause

montage -geometry ":" ... reaches MagickCore/geometry.c:GetGeometry().
StringToDouble/InterpretLocaleValue parses ":" as 0.0; then: https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355 WidthValue (and/or HeightValue) is set with a zero dimension.
In MagickCore/resize.c:ThumbnailImage(), the code computes: https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629 causing a division by zero and immediate crash.

The issue is trivially triggerable without external input files (e.g., using xc:white).

Reproduction

Environment

Version: ImageMagick 7.1.2-1 (Beta) Q16-HDRI x86_64 0ba1b587b:20250812 https://imagemagick.org
Features: Cipher DPC HDRI
Delegates (built-in): bzlib fontconfig freetype jbig jng jpeg lcms lzma pangocairo png tiff x xml zlib
Compiler: clang (14.0.0)
OS/Arch: Linux x86_64

Steps

./bin/magick montage -geometry : xc:white null:

Observed result

IOT instruction (core dumped)
# (Environment-dependent: SIGFPE/abort may be observed.)

PoC

No external file required; the pseudo image xc:white suffices:

./bin/magick montage -geometry : xc:white null:

Impact

Denial of Service: A divide-by-zero in ThumbnailImage() causes immediate abnormal termination (e.g., SIGFPE/abort), crashing the ImageMagick process.

Miggo Vulnerability Database

→

CVE-2025-55212

CVE-2025-55212:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.8.1	14.8.1
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.8.1	14.8.1
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.8.1	14.8.1
Magick.NET-Q16-HDRI-OpenMP-x64	nuget	< 14.8.1	14.8.1
Magick.NET-Q16-HDRI-arm64	nuget	< 14.8.1	14.8.1
Magick.NET-Q16-HDRI-x64	nuget	< 14.8.1	14.8.1
Magick.NET-Q16-HDRI-x86	nuget	< 14.8.1	14.8.1
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.8.1	14.8.1
Magick.NET-Q16-OpenMP-x64	nuget	< 14.8.1	14.8.1
Magick.NET-Q16-arm64	nuget	< 14.8.1	14.8.1
Magick.NET-Q16-x64	nuget	< 14.8.1	14.8.1
Magick.NET-Q16-x86	nuget	< 14.8.1	14.8.1
Magick.NET-Q8-AnyCPU	nuget	< 14.8.1	14.8.1
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.8.1	14.8.1
Magick.NET-Q8-OpenMP-x64	nuget	< 14.8.1	14.8.1
Magick.NET-Q8-arm64	nuget	< 14.8.1	14.8.1
Magick.NET-Q8-x64	nuget	< 14.8.1	14.8.1
Magick.NET-Q8-x86	nuget	< 14.8.1	14.8.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic divide-by-zero error within the ImageMagick library, specifically triggered when processing a malformed geometry string. The analysis of the vulnerability description and the associated patch leads to the identification of two key functions involved in this vulnerability.

The primary vulnerable function, where the crash occurs, is ThumbnailImage. The provided patch directly modifies this function, replacing a direct division operation with a call to MagickSafeReciprocal. This change is a direct mitigation of the crash, confirming that ThumbnailImage is where the division by zero happens. During runtime exploitation, this function would be present in the stack trace at the moment of the crash.

The secondary function, which is the root cause of the issue, is GetGeometry. According to the vulnerability report, this function is responsible for parsing the user-provided geometry string. It fails to properly validate the input ":", resulting in it returning a width and/or height of zero. While the provided patch does not modify this function, the vulnerability report explicitly mentions it as the origin of the invalid values. Therefore, GetGeometry is a critical function in the vulnerability chain, as it processes the malicious input. A security engineer should be aware of both functions to fully understand and address the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

3.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-55212: ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crash

Summary

Details

Reproduction

PoC

Impact

CVE-2025-55212:

3.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

3.7

3.7

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2025-55212: ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crash

Summary

Details

Reproduction

PoC

Impact

Basic Information

Basic Information

Suggested fix

Credits

Team Daemon Fuzz Hunters

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI