Wiz
Vulnerability DatabaseCVE-2023-2157

CVE-2023-2157: 
ImageMagick vulnerability analysis and mitigation

Overview

A heap-based buffer overflow vulnerability (CVE-2023-2157) was discovered in the ImageMagick package. The vulnerability was reported on April 18, 2023, and affects specific versions of ImageMagick software. This security issue can potentially lead to application crashes when processing certain image files (NVD, Red Hat).

Technical details

The vulnerability is classified as a heap-based buffer overflow with a CVSS 3.1 base score of 5.5 (Medium severity). The attack vector is local, requiring user interaction but no special privileges. The vulnerability primarily impacts system availability, with no direct effects on confidentiality or integrity (Ubuntu).

Impact

The primary impact of this vulnerability is the potential for application crashes, affecting the availability of ImageMagick services. The vulnerability does not appear to have any direct impact on system confidentiality or integrity (NVD).

Mitigation and workarounds

The vulnerability has been fixed in ImageMagick version 7.1.1-9. The fix was implemented through commits 9a9896fce95d09e5e47b86baccbe1ce1a2fca76b (for ImageMagick 7.1.1-7) and 7e4c992f148afc5b28111e540921d5b6e4e38673 (for ImageMagick 6.9.12-85). Users are advised to update to the fixed versions (Debian).

Additional resources

Source: This report was generated using AI

Related ImageMagick vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2025-57807CRITICAL9.8
  • C#C#
  • ImageMagick-config-7-upstream-limited
NoYesSep 05, 2025
CVE-2025-66628HIGH7.5
  • C#C#
  • seal-ImageMagick
NoYesDec 10, 2025
CVE-2025-62171HIGH7.5
  • C#C#
  • ImageMagick
NoYesOct 17, 2025
CVE-2025-62594MEDIUM5.5
  • C#C#
  • imagemagick
NoYesOct 27, 2025
CVE-2025-65955MEDIUM4.9
  • C#C#
  • ImageMagick-devel
NoYesDec 02, 2025

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo