Heap Use-After-Free Vulnerability in ImageMagick by ImageMagick Studio LLC
CVE-2022-1114

7.1HIGH

Key Information:

Vendor
Imagemagick
Status
Imagemagick
Vendor
CVE Published:
29 April 2022

Summary

A heap-use-after-free vulnerability exists in the RelinquishDCMInfo() function within the dcm.c file of ImageMagick. This issue arises when an attacker supplies a specially crafted DICOM image file for conversion, which can trigger manipulation of memory allocations. As a result, this flaw could lead to potential information disclosure or cause a denial of service, impacting users and applications relying on ImageMagick for image processing.

Affected Version(s)

ImageMagick ImageMagick6 v6.9.12-43, ImageMagick7 v7.1.0-28

References

https://bugzilla.redhat.com/show_bug.cgi?id=2064538
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.