Integer Overflow Vulnerability in ImageMagick by ImageMagick
CVE-2021-20224

5.5MEDIUM

Key Information:

Vendor

Imagemagick
Status
Imagemagick
Vendor
CVE Published:
25 August 2022

What is CVE-2021-20224?

An integer overflow vulnerability exists within the ExportIndexQuantum() function of ImageMagick. This flaw occurs in the handling of pixel data when processing specially crafted PDF files. It may allow attackers to trigger an overflow in values expected by GetPixelIndex(), leading to unexpected behaviors or potential crashes. Users of affected ImageMagick versions should update to mitigate risks associated with this vulnerability.

Affected Version(s)

ImageMagick Fixed in ImageMagick-7.0.10-57, ImageMagick6-6.9.11-57

References

https://github.com/ImageMagick/ImageMagick/pull/3083
https://github.com/ImageMagick/ImageMagick/commit/5af1dff...
https://github.com/ImageMagick/ImageMagick6/commit/553054...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2021-20224 : Integer Overflow Vulnerability in ImageMagick by ImageMagick