CVE-2025-66628: 
C# vulnerability analysis and mitigation

CVE-2025-66628 is an integer overflow vulnerability in ImageMagick's TIM (PSX TIM) image parser that leads to an out-of-bounds read, enabling arbitrary memory disclosure on 32-bit systems. It affects ImageMagick versions up to and including 7.1.2-9, as well as Magick.NET NuGet packages prior to version 14.10.0. The vulnerability was discovered by researcher Sumitshah00 and publicly disclosed on December 10, 2025. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Github Advisory).

The root cause is an integer overflow (CWE-125: Out-of-bounds Read) in the ReadTIMImage function within coders/tim.c. The code reads 16-bit width and height values from a TIM file header and computes image_size = 2 * width * height at line 234 without any overflow check. On 32-bit systems (or where size_t is 32-bit), supplying maximum values such as 65535 for both dimensions causes the multiplication to wrap around to a small value, resulting in an undersized heap allocation via AcquireQuantumMemory. Subsequent operations that rely on the original dimensions then read beyond the allocated buffer, triggering an out-of-bounds read that can disclose arbitrary heap memory. The attack vector is network-accessible with no authentication or user interaction required, as an attacker only needs to supply a crafted TIM image file to a vulnerable ImageMagick instance (GitHub Advisory, Github Advisory).

Successful exploitation results in arbitrary memory disclosure — an attacker can read heap memory contents beyond the intended buffer boundary, potentially exposing sensitive data such as cryptographic keys, credentials, or other in-memory secrets processed by the ImageMagick instance. The confidentiality impact is rated High, while integrity and availability are unaffected. The vulnerability is strictly limited to 32-bit builds or environments where size_t is 32-bit; 64-bit deployments are not affected (GitHub Advisory, bugzilla.redhat.com).

No public exploit code or in-the-wild exploitation has been reported for CVE-2025-66628. The EPSS score is approximately 0.031–0.047%, placing it in the 15th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the target to be running a 32-bit build of ImageMagick and to process attacker-supplied TIM image files, which limits the practical attack surface (Github Advisory).

1. Identify target: Locate a service or application running a 32-bit build of ImageMagick (version ≤ 7.1.2-9) that accepts user-supplied image files for processing (e.g., a web application with image upload functionality).
2. Craft malicious TIM file: Create a PSX TIM image file with the width and height fields in the header set to 65535 (0xFFFF). This causes image_size = 2 * 65535 * 65535 to overflow to a small value on 32-bit systems.
3. Submit the file: Upload or otherwise deliver the crafted TIM file to the target application so that ImageMagick's ReadTIMImage function processes it.
4. Trigger out-of-bounds read: The undersized heap buffer is allocated via AcquireQuantumMemory, and subsequent image processing operations read beyond the buffer boundary, disclosing adjacent heap memory contents.
5. Extract disclosed memory: Depending on the application's response behavior (e.g., error messages, image metadata returned), analyze the output to recover sensitive data from the process heap (GitHub Advisory).

• Network: Unusual uploads of .tim files or files with TIM magic bytes to image-processing endpoints; unexpected outbound data transfers from ImageMagick-hosting servers following image processing requests.
• File System: Presence of crafted TIM files (PSX TIM format, magic bytes 0x10 0x00 0x00 0x00) with width/height fields set to 0xFFFF in upload directories or temporary processing folders.
• Logs: Application or web server logs showing repeated submission of TIM-format images to processing endpoints; ImageMagick error logs referencing coders/tim.c or ReadTIMImage with memory-related errors.
• Process: Abnormal memory access violations or segmentation faults in 32-bit ImageMagick processes; unexpected heap corruption signals in application crash reports.

The primary remediation is to upgrade ImageMagick to version 7.1.2-10 or later, which includes the fix for the integer overflow in coders/tim.c. For Magick.NET users, upgrading to version 14.10.0 or later is required. As a workaround, organizations can configure ImageMagick's security policy (policy.xml) to disable processing of TIM format images by denying the TIM coder. Deployments should also prefer 64-bit builds of ImageMagick, as the vulnerability only affects 32-bit builds. Debian LTS users should apply the DLA-4429-1 security update (GitHub Advisory, Github Advisory, bugzilla.redhat.com).

The vulnerability was reported by researcher Sumitshah00, who published a write-up on Medium describing the discovery process. Red Hat tracked the issue via Bugzilla (Bug 2421159) and rated it high severity. Debian issued a Long Term Support security advisory (DLA-4429-1), and SUSE released a corresponding update. Security news outlet SecurityOnline.info covered the flaw, highlighting the risk of arbitrary memory disclosure via PSX TIM file processing on 32-bit systems (GitHub Advisory, bugzilla.redhat.com).