{"id":"CVE-2025-62594","summary":"ImageMagick CLAHE : Unsigned underflow and division-by-zero lead to OOB pointer arithmetic and process crash (DoS)","details":"ImageMagick is a software suite to create, edit, compose, or convert bitmap images. ImageMagick versions prior to 7.1.2-8 are vulnerable to denial-of-service due to unsigned integer underflow and division-by-zero in the CLAHEImage function. When tile width or height is zero, unsigned underflow occurs in pointer arithmetic, leading to out-of-bounds memory access, and division-by-zero causes immediate crashes. This issue has been patched in version 7.1.2-8.","aliases":["GHSA-wpp4-vqfq-v4hp"],"modified":"2026-08-18T17:53:59.126806Z","published":"2025-10-27T20:00:33.205Z","related":["SUSE-SU-2025:21211-1","SUSE-SU-2025:3956-1","SUSE-SU-2025:3978-1","SUSE-SU-2025:3985-1","openSUSE-SU-2025:15685-1","openSUSE-SU-2025:20162-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-119","CWE-191","CWE-369"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62594.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62594.json"},{"type":"ADVISORY","url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wpp4-vqfq-v4hp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62594"},{"type":"FIX","url":"https://github.com/ImageMagick/ImageMagick/commit/7b47fe369eda90483402fcd3d78fa4167d3bb129"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/imagemagick/imagemagick","events":[{"introduced":"0"},{"fixed":"a3b13d143fd7dea44cd71d31aa02f411b597688f"},{"fixed":"7b47fe369eda90483402fcd3d78fa4167d3bb129"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"7.1.2-8"}]}}],"versions":["7.1.2-7","7.1.2-6","7.1.2-5","7.1.2-3","7.1.2-2","7.1.2-1","7.1.2-0","7.1.1-47","7.1.1-46","7.1.1-45","7.1.1-44","7.1.1-43","7.1.1-41","7.1.1-40","7.1.1-39","7.1.1-38","7.1.1-37","7.1.1-36","7.1.1-35","7.1.1-34","7.1.1-33","7.1.1-32","7.1.1-31","7.1.1-30","7.1.1-29","7.1.1-28","7.1.1-27","7.1.1-26","7.1.1-25","7.1.1-24","7.1.1-23","7.1.1-22","7.1.1-21","7.1.1-20","7.1.1-19","7.1.1-18","7.1.1-17","7.1.1-16","7.1.1-15","7.1.1-14","7.1.1-13","7.1.1-12","7.1.1-11","7.1.1-10","7.1.1-9","7.1.1-8","7.1.1-7","7.1.1-6","7.1.1-5","7.1.1-4","7.1.1-3","7.1.1-2","7.1.1-1","7.1.1-0","7.1.0-62","7.1.0-61","7.1.0-60","7.1.0-59","7.1.0-58","7.1.0-57","7.1.0-56","7.1.0-55","7.1.0-54","7.1.0-53","7.1.0-52","7.1.0-51","7.1.0-50","7.1.0-49","7.1.0-48","7.1.0-47","7.1.0-46","7.1.0-45","7.1.0-44","7.1.0-43","7.1.0-42","7.1.0-41","7.1.0-40","7.1.0-39","7.1.0-38","7.1.0-37","7.1.0-36","7.1.0-35","7.1.0-34","7.1.0-33","7.1.0-32","7.1.0-31","7.1.0-30","7.1.0-29","7.1.0-28","7.1.0-27","7.1.0-26","7.1.0-25","7.1.0-24","7.1.0-23","7.1.0-22","7.1.0-21","7.1.0-20","7.1.0-19","7.1.0-18","7.1.0-17","7.1.0-16","7.1.0-15","7.1.0-14","7.1.0-13","7.1.0-12","7.1.0-11","7.1.0-10","7.1.0-9","7.1.0-8","7.1.0-7","7.1.0-6","7.1.0-5","7.1.0-4","7.1.0-3","7.1.0-2","7.1.0-1","7.1.0-0","7.0.11-14","7.0.11-13","7.0.11-12","7.0.11-11","7.0.11-10","7.0.11-9","7.0.11-8","7.0.11-7","7.0.11-6","7.0.11-5","7.0.11-4","7.0.11-3","7.0.11-2","7.0.11-1","7.0.11-0","7.0.10-62","7.0.10-61","7.0.10-60","7.0.10-59","7.0.10-58","7.0.10-57","7.0.10-56","7.0.10-55","7.0.10-54","7.0.10-53","7.0.10-52","7.0.10-51","7.0.10-50","7.0.10-49","7.0.10-48","7.0.10-47","7.0.10-46","7.0.10-45","7.0.10-44","7.0.10-43","7.0.10-42","7.0.10-41","7.0.10-40","7.0.10-39","7.0.10-38","7.0.10-37","7.0.10-36","7.0.10-35","7.0.10-34","7.0.10-33","7.0.10-32","7.0.10-31","7.0.10-30","7.0.10-29","7.0.10-28","7.0.10-27","7.0.10-26","7.0.10-25","7.0.10-24","7.0.10-23","7.0.10-22","7.0.10-21","7.0.10-20","7.0.10-19","7.0.10-18","7.0.10-17","7.0.10-16","7.0.10-15","7.0.10-14","7.0.10-13","7.0.10-12","7.0.10-11","7.0.10-10","7.0.10-9","7.0.10-8","7.0.10-7","7.0.10-6","7.0.10-5","7.0.10-4","7.0.10-3","7.0.10-2","7.0.10-1","7.0.10-0","7.0.9-27","7.0.9-26","7.0.9-25","7.0.9-24","7.0.9-23","7.0.9-22","7.0.9-21","7.0.9-20","7.0.9-19","7.0.9-18","7.0.9-17","7.0.9-16","7.0.9-15","7.0.9-14","7.0.9-13","7.0.9-12","7.0.9-11","7.0.9-10","7.0.9-9","7.0.9-8","7.0.9-7","7.0.9-6","7.0.9-5","7.0.9-4","7.0.9-2","7.0.9-1","7.0.9-0","7.0.8-68","7.0.8-67","7.0.8-66","7.0.8-65","7.0.8-64","7.0.8-63","7.0.8-62","7.0.8-61","7.0.8-60","7.0.8-59","7.0.8-58","7.0.8-57","7.0.8-56","7.0.8-55","7.0.8-54","7.0.8-53","7.0.8-52","7.0.8-51","7.0.8-50","7.0.8-49","7.0.8-48","7.0.8-47","7.0.8-46","7.0.8-45","7.0.8-44","7.0.8-43","7.0.8-42","7.0.8-41","7.0.8-40","7.0.8-39","7.0.8-38","7.0.8-37","7.0.8-36","7.0.8-35","7.0.8-34","7.0.8-33","7.0.8-32","7.0.8-31","7.0.8-30","7.0.8-29","7.0.8-28","7.0.8-27","7.0.8-26","7.0.8-25","7.0.8-24","7.0.8-23","7.0.8-22","7.0.8-21","7.0.8-20","7.0.8-19","7.0.8-18","7.0.8-17","7.0.8-16","7.0.8-15","7.0.8-14","7.0.8-13","7.0.8-12","7.0.8-11","7.0.8-10","7.0.8-9","7.0.8-8","7.0.8-7","7.0.8-6","7.0.8-5","7.0.8-4","7.0.8-3","7.0.8-2","7.0.8-1","7.0.8-0","7.0.7-39","7.0.7-38","7.0.7-37","7.0.7-36","7.0.7-35","7.0.7-34","7.0.7-33","7.0.7-32","7.0.7-31","7.0.7-30","7.0.7-29","7.0.7-28","7.0.7-27","7.0.7-26","7.0.7-25","7.0.7-24","7.0.7-23","7.0.7-22","7.0.7-21","7.0.7-20","7.0.7-19","7.0.7-18","7.0.7-17","7.0.7-16","7.0.7-15","7.0.7-14","7.0.7-13","7.0.7-12","7.0.7-11","7.0.7-10","7.0.7-9","7.0.7-8","7.0.7.7","7.0.7-6","7.0.7-5","7.0.7-4","7.0.7-3","7.0.7-2","7.0.7-1","7.0.7-0","7.0.6-9","7.0.6-8","7.0.6-7","7.0.6-6","7.0.6-5","7.0.6-4","7.0.6-3","7.0.6-2","7.0.6-1","7.0.6-0","7.0.5-10","7.0.5-9","7.0.5-8","7.0.5-7","7.0.5-6","7.0.5-5","7.0.5-4","7.0.5-3","7.0.5-2","7.0.5-1","7.0.5-0","7.0.4-10","7.0.4-9","7.0.4-8","7.0.4-7","7.0.4-6","7.0.4-5","7.0.4-4","7.0.4-3","7.0.4-2","7.0.4-1","7.0.4-0","7.0.3-10","7.0.3-9","7.0.3-8","7.0.3-7","7.0.3-6","7.0.3-5","7.0.3-4","7.0.3-3","7.0.3-2","7.0.3-1","7.0.3-0","7.0.2-10","7.0.2-9","7.0.2-8","7.0.2-7","7.0.2-6","7.0.2-5","7.0.2-4","7.0.2-3","7.0.2-2","7.0.2-1","7.0.2-0","7.0.1-10","7.0.1-9","7.0.1-8","7.0.1-7","7.0.1-6","7.0.1-5","7.0.1-4","7.0.1-3","7.0.1-2","7.0.1-1","7.0.1-0"],"database_specific":{"vanir_signatures_modified":"2026-08-18T17:53:59Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/imagemagick/imagemagick/commit/7b47fe369eda90483402fcd3d78fa4167d3bb129","target":{"file":"MagickCore/image-private.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["93978249271453435443370779435701021420","185649092799577856230529050517169541096","322828384803911328086970329658842429215","87859365718900108450921729030062184669","146441977349911099924069941216449471036","178912587316773556356173386432215380729","305040874840833206973180670214223783916","196941319566124660537016250058849962010","177393780350412965486115592973269514972","52883889520580296632974496819058253158","337164425926113651308719924800408687579","229445334115858512414725516951625703445","124452363971452924200757284471545904088","286675244255741051959532514802052014473","258381038938817179434980738413737297870","64710009607402181407512143923322433503","63637053296696152105458150330756832153","157463802344651814039137746813082848710","60701446639991467551869529227894862898","318892597365511757175110485101723034229","1965020146989427329380204134185007441","38844885043965604307214640472928814465","289971997879375024485066465690706917337","316105469341376436700743319302649738581","57013811621863345306178238886191654396","23133525470606502513781841277461613657","195249458981155318096729492593763954463","31282131216712916578897233678564788285","5424675147208047878120055808577182400","160143883896784752628590329187573996211","58200360412650565937713919709600423074","320084253977001991824134409710646951332","274173753373368012614535947682982190209","266075636474480113239204934946972274553","196941319566124660537016250058849962010","41998303235079722157453652297011832929","318908162997070760324599418396910751152","59588149542938092042088075490441887056","24949320131938541583342663661070982967","6998251514216590133234118023327471954","161268418238419763849274086273054301705","104962749595633344805409608409299053861","43024357926118940853088667608946633200","22538891656690264464332611690421951218","201916521127789837876762604356448179118","70634505972689263966259636022140032164","201700098879835109919410593444234925211","59397535445919270618907294864216346389","333074141710635353878506192750459148821","30242551168597993018269677514085729734","185501065801769375592802142214300870377","190898178576904413137768637633895102319","111303653103433377371571388283257311789","286903367158046765400827113132085839018","159063181938296830828330299804576383389","208641174018012903719257581940553680069","190057174857525898313444957951364072002","196385285021825422329946320647747749236","57013811621863345306178238886191654396","319117765692350302404697983128714502839","174950589579299354338612874288166439614","129247783737853168209004077885970316778","235945783231621924770708580806371069246","166932885396175865668689124398923625362","161538786617152871099573141716432338314","218373161457201493573121755972993377302","274173753373368012614535947682982190209","266075636474480113239204934946972274553","196941319566124660537016250058849962010","299285722074072481263360281591815528717","167113864748817092112712331581119984698","57013811621863345306178238886191654396","321589358012574183896967294626626137589","74970457178494002310577682124547743633","759109166066192955255021061314205206","34848868941701854985225712566944097868","36701877629367291448115350164004734057","145561057700276485324106277888503185018","44157409007235770404890474505876263946","274173753373368012614535947682982190209","266075636474480113239204934946972274553","196941319566124660537016250058849962010","88505835752320963755628573452441321806","188050741881766409337783424767571825659"]},"id":"CVE-2025-62594-3ff35465"},{"digest":{"function_hash":"260044499070455729476866208511379746243","length":318},"id":"CVE-2025-62594-53b3ae7d","signature_type":"Function","signature_version":"v1","source":"https://github.com/imagemagick/imagemagick/commit/7b47fe369eda90483402fcd3d78fa4167d3bb129","target":{"file":"MagickCore/image-private.h","function":"CastDoubleToQuantumAny"},"deprecated":false},{"source":"https://github.com/imagemagick/imagemagick/commit/7b47fe369eda90483402fcd3d78fa4167d3bb129","target":{"file":"MagickCore/image-private.h","function":"CastDoubleToSizeT"},"deprecated":false,"digest":{"function_hash":"89875844816696822053183334041980477235","length":344},"id":"CVE-2025-62594-6d3ab3ca","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2025-62594-a7980796","signature_type":"Line","signature_version":"v1","source":"https://github.com/imagemagick/imagemagick/commit/7b47fe369eda90483402fcd3d78fa4167d3bb129","target":{"file":"MagickCore/enhance.c"},"deprecated":false,"digest":{"line_hashes":["224919491707613947098546120478219146527","22929925738299477301413878186195813217","117151908620914107153457132612109801719","303985443703417035941649651667064252921","104048651684552674903585161762590369449","195637518678803997873782990089007034591","269779658233072761583968038533303413584","313099479440129096751722050539357161134","281389158501563385880540495119872858528","38956265189413909759799046045509524274","243291315945057449647655408402035965335","325993000545581697320123073664653369078","168606850254058850285127761802974252109","325887186187216369465019129862679833825","202860324076107336029609747149409664511","65997677737869958455294522144352095347","282015292809027085559028392621054236438","49199723144978304721164613687975879949","162247210154242759370421484653899622796","250077975279386777811018753539508220703","71893790781705111523970699626003838184","182317655410325811095117076388408359626","180504248175477393372319903044053384348","114261007460347065155738341941462594620","133342235522802668994526655535288547023","54036345667502802084933787440896213865","32519922804753348314604540946476793252","274214936997325702811216893009760071444","288953125196756068411524738858325352506","180160406394534839975929203902212375860","149353059888880425115419814837122284167","310550851119728490031995884475678555287","222930910422385441995675391719034481853","194327944269582363897149656354095414175","328664083028695873902990204713029151627","39282619112586746372972534061957978107","214511345358837057707960069576845457695","91398815317942229131622953626944505015","133285990904454274715536210029522754551","223193617868153550287693878344651968910","14131933197506340441428278355807058950","276746954249222724450682128386943265748","48515497468705873490383605369383853906","281612462369671727908150178291310479270","284326997402109749687129071735263397445","158738073662537512134006392273421006400","249614574685603069327363457434351865662","96898252133675301128216787476255291168","320873098577116595721890313311258942542","215563603566841943983389696957667845743","6547608616805424787748737135425669209","178493031703711456117385194064205405029","72183166930050025913442619859716062608","7746485962431356580576046818866460130","102658146701826297984345070176646215314","293978506816194368414392592976944249081"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/imagemagick/imagemagick/commit/7b47fe369eda90483402fcd3d78fa4167d3bb129","target":{"function":"CLAHE","file":"MagickCore/enhance.c"},"deprecated":false,"digest":{"function_hash":"195646918572515467100578588920798393006","length":2595},"id":"CVE-2025-62594-ab8acf7c","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"298259415727341826805148847509268244065","length":371},"id":"CVE-2025-62594-ae2485d5","signature_type":"Function","signature_version":"v1","source":"https://github.com/imagemagick/imagemagick/commit/7b47fe369eda90483402fcd3d78fa4167d3bb129","target":{"file":"MagickCore/image-private.h","function":"CastDoubleToUInt"}},{"deprecated":false,"digest":{"function_hash":"47253208098675415607161965068746281616","length":3611},"id":"CVE-2025-62594-cf589196","signature_type":"Function","signature_version":"v1","source":"https://github.com/imagemagick/imagemagick/commit/7b47fe369eda90483402fcd3d78fa4167d3bb129","target":{"file":"MagickCore/enhance.c","function":"CLAHEImage"}},{"deprecated":false,"digest":{"function_hash":"15269090216107693374410781408637422235","length":1018},"id":"CVE-2025-62594-d3872ba3","signature_type":"Function","signature_version":"v1","source":"https://github.com/imagemagick/imagemagick/commit/7b47fe369eda90483402fcd3d78fa4167d3bb129","target":{"file":"MagickCore/enhance.c","function":"ClipCLAHEHistogram"}},{"signature_version":"v1","source":"https://github.com/imagemagick/imagemagick/commit/7b47fe369eda90483402fcd3d78fa4167d3bb129","target":{"file":"MagickCore/image-private.h","function":"CastDoubleToSsizeT"},"deprecated":false,"digest":{"function_hash":"81824786992952549755418788013462723200","length":456},"id":"CVE-2025-62594-f65d5970","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/imagemagick/imagemagick/commit/7b47fe369eda90483402fcd3d78fa4167d3bb129","target":{"file":"MagickCore/image-private.h","function":"CastDoubleToUShort"},"deprecated":false,"digest":{"function_hash":"9152553627433820815773485613833209151","length":375},"id":"CVE-2025-62594-feceeaa1","signature_type":"Function"}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-62594.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}