CVE-2025-65955: 
C# vulnerability analysis and mitigation

CVE-2025-65955 is a use-after-free and double-free vulnerability in ImageMagick's Magick++ C++ API layer, specifically in the Options::fontFamily method when invoked with an empty string. It affects all ImageMagick releases from version 7.0.1-0 up to (excluding) 7.1.2-9, and all 6.x releases prior to 6.9.13-34. The vulnerability was disclosed on December 2, 2025, with patches released the same day. NIST NVD assigns a CVSS v3.1 base score of 6.1 (Medium), while the GitHub CNA rates it 4.9 (Medium) (GitHub Advisory, Red Hat).

The root cause is a typo introduced in commit 6409f34 (August 2015) when fontFamily support was added to the Magick++ Image class (CWE-416: Use After Free; CWE-415: Double Free). When Options::fontFamily is called with an empty string, the code incorrectly calls RelinquishMagickMemory(_drawInfo->font) instead of RelinquishMagickMemory(_drawInfo->family), freeing the font string and assigning the now-dangling pointer to _drawInfo->family. Subsequent operations — including DestroyDrawInfo, Options::font, and Image::font — that assume _drawInfo->font remains valid will re-free or dereference this dangling pointer, triggering crashes or heap corruption. Critically, this code path is not reachable from the command-line interface; it is exclusive to applications using the Magick++ C++ API directly (GitHub Advisory, Fix Commit).

Successful exploitation can cause application crashes (denial of service) and heap memory corruption, with a potential — though unconfirmed — path to arbitrary code execution in applications that use the Magick++ API. The vulnerability has high availability impact and low integrity impact; confidentiality impact is assessed as none by NIST. Because the flaw is confined to the Magick++ C++ API layer and cannot be triggered via command-line tools, the attack surface is limited to software that programmatically invokes Options::fontFamily with an empty string (GitHub Advisory, Red Hat).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The CVE was briefly rejected by GitHub on December 5, 2025 (with a note that "further research determined the issue is not a vulnerability"), then un-rejected on December 11, 2025, reflecting some initial uncertainty about its severity. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Upgrade ImageMagick to version 7.1.2-9 (for the 7.x branch) or 6.9.13-34 (for the 6.x branch), which contain the one-line fix changing RelinquishMagickMemory(_drawInfo->font) to RelinquishMagickMemory(_drawInfo->family) in Magick++/lib/Options.cpp (Fix Commit). As a workaround where patching is not immediately possible, avoid passing empty strings to Options::fontFamily in any Magick++ application code, and validate/sanitize all font-family parameters before use. Downstream distributions including Debian LTS, Amazon Linux 2, and SUSE have issued updated packages (Debian LTS, Amazon Linux).

The vulnerability was reported by Luigino Camastra of Aisle Research and published via GitHub's security advisory program (GitHub Advisory). The CVE underwent a notable lifecycle event: it was temporarily rejected by GitHub on December 5, 2025, with the rationale that "further research determined the issue is not a vulnerability," before being reinstated on December 11, 2025 — suggesting internal debate about exploitability. Red Hat tracked it as medium severity, and multiple Linux distributions (Debian, SUSE, Amazon Linux) issued security updates, indicating broad ecosystem acknowledgment (Red Hat).