CVE-2025-46393: 
ImageMagick vulnerability analysis and mitigation

CVE-2025-46393 is a vulnerability discovered in ImageMagick before version 7.1.1-44, affecting the multispectral MIFF image processing functionality. The vulnerability was disclosed on April 23, 2025, and involves the mishandling of packet_size related to the rendering of all channels in an arbitrary order (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 2.9 (LOW) with the vector string CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L. The issue is classified as CWE-131 (Incorrect Calculation of Buffer Size). The technical root cause involves improper handling of packet_size calculations when processing multispectral MIFF images, specifically in relation to channel rendering (NVD, Red Hat).

The vulnerability has a low severity impact primarily affecting system availability. The issue does not pose risks to confidentiality or integrity of the system, but may lead to application instability or crashes when processing specially crafted MIFF images (Red Hat).

The vulnerability has been fixed in ImageMagick version 7.1.1-44. Users are advised to upgrade to this version or later to address the issue. The fix involves modifying how packet_size is calculated for multispectral MIFF images (ImageMagick Commit).