CVE-2025-66628: 
C# vulnerability analysis and mitigation

CVE-2025-66628 is an integer overflow vulnerability in ImageMagick's TIM (PSX TIM) image parser that leads to an out-of-bounds read, enabling arbitrary memory disclosure on 32-bit systems. It affects ImageMagick versions up to and including 7.1.2-9, as well as Magick.NET NuGet packages prior to version 14.10.0. The vulnerability was discovered by researcher Sumitshah00 and publicly disclosed on December 10, 2025. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Github Advisory).

The root cause is an integer overflow (CWE-125: Out-of-bounds Read) in the ReadTIMImage function within coders/tim.c. The code reads 16-bit width and height values from a TIM file header and computes image_size = 2 * width * height at line 234 without any overflow check. On 32-bit systems (or where size_t is 32-bit), supplying maximum values such as 65535 for both dimensions causes the multiplication to wrap around to a small value, resulting in an undersized heap allocation via AcquireQuantumMemory. Subsequent operations that rely on the original dimensions then read beyond the allocated buffer, triggering an out-of-bounds read that can disclose arbitrary heap memory. The attack vector is network-accessible with no authentication or user interaction required, as an attacker only needs to supply a crafted TIM image file to a vulnerable ImageMagick instance (GitHub Advisory, Github Advisory).

Successful exploitation results in arbitrary memory disclosure — an attacker can read heap memory contents beyond the intended buffer boundary, potentially exposing sensitive data such as cryptographic keys, credentials, or other in-memory secrets processed by the ImageMagick instance. The confidentiality impact is rated High, while integrity and availability are unaffected. The vulnerability is strictly limited to 32-bit builds or environments where size_t is 32-bit; 64-bit deployments are not affected (GitHub Advisory, bugzilla.redhat.com).

1. Identify target: Locate a service or application running a 32-bit build of ImageMagick (version ≤ 7.1.2-9) that accepts user-supplied image files for processing (e.g., a web application with image upload functionality).
2. Craft malicious TIM file: Create a PSX TIM image file with the width and height fields in the header set to 65535 (0xFFFF). This causes image_size = 2 * 65535 * 65535 to overflow to a small value on 32-bit systems.
3. Submit the file: Upload or otherwise deliver the crafted TIM file to the target application so that ImageMagick's ReadTIMImage function processes it.
4. Trigger out-of-bounds read: The undersized heap buffer is allocated via AcquireQuantumMemory, and subsequent image processing operations read beyond the buffer boundary, disclosing adjacent heap memory contents.
5. Extract disclosed memory: Depending on the application's response behavior (e.g., error messages, image metadata returned), analyze the output to recover sensitive data from the process heap (GitHub Advisory).

• Network: Unusual uploads of .tim files or files with TIM magic bytes to image-processing endpoints; unexpected outbound data transfers from ImageMagick-hosting servers following image processing requests.
• File System: Presence of crafted TIM files (PSX TIM format, magic bytes 0x10 0x00 0x00 0x00) with width/height fields set to 0xFFFF in upload directories or temporary processing folders.
• Logs: Application or web server logs showing repeated submission of TIM-format images to processing endpoints; ImageMagick error logs referencing coders/tim.c or ReadTIMImage with memory-related errors.
• Process: Abnormal memory access violations or segmentation faults in 32-bit ImageMagick processes; unexpected heap corruption signals in application crash reports.

The primary remediation is to upgrade ImageMagick to version 7.1.2-10 or later, which includes the fix for the integer overflow in coders/tim.c. For Magick.NET users, upgrading to version 14.10.0 or later is required. As a workaround, organizations can configure ImageMagick's security policy (policy.xml) to disable processing of TIM format images by denying the TIM coder. Deployments should also prefer 64-bit builds of ImageMagick, as the vulnerability only affects 32-bit builds. Debian LTS users should apply the DLA-4429-1 security update (GitHub Advisory, Github Advisory, bugzilla.redhat.com).

The vulnerability was reported by researcher Sumitshah00, who published a write-up on Medium describing the discovery process. Red Hat tracked the issue via Bugzilla (Bug 2421159) and rated it high severity. Debian issued a Long Term Support security advisory (DLA-4429-1), and SUSE released a corresponding update. Security news outlet SecurityOnline.info covered the flaw, highlighting the risk of arbitrary memory disclosure via PSX TIM file processing on 32-bit systems (GitHub Advisory, bugzilla.redhat.com).