CVE-2020-10938

Vulnerability

GraphicsMagick versions before 1.3.35 contain an integer overflow that results in a heap-based buffer overflow in the HuffmanDecodeImage function in magick/compress.c. The vulnerability occurs when processing specially crafted image files that trigger incorrect buffer size calculations during Huffman decoding, allowing a write beyond the allocated heap buffer. This is reachable when GraphicsMagick processes untrusted image files via any supported input format that uses Huffman decoding.

Exploitation

An attacker can exploit this vulnerability by providing a malicious image file to a user or service using GraphicsMagick to process images. No authentication or special network position is required; the attack vector is local or remote file processing. The attacker crafts a file that, when decoded by HuffmanDecodeImage, triggers the integer overflow and subsequent heap-based out-of-bounds write.

Impact

Successful exploitation can lead to arbitrary code execution in the context of the GraphicsMagick process, or denial of service via application crash. The heap-based buffer overflow can be leveraged by an attacker to corrupt memory and potentially achieve remote code execution if the application processes images from untrusted sources.

Mitigation

The vulnerability is fixed in GraphicsMagick version 1.3.35, released on or around February 23, 2020 [1]. Users should upgrade to version 1.3.35 or later. There is no known workaround for this issue; users running earlier versions should apply the patch immediately.