CVE-2020-21679

Vulnerability

The WritePCXImage function in pcx.c in GraphicsMagick 1.4 contains a heap-buffer-overflow vulnerability. An integer underflow or miscalculated write leads to an out-of-bounds write at pcx.c:1255 when processing a carefully crafted image during conversion to the PCX format. This occurs when the gm utility or library attempts to write PCX output, affecting all versions of GraphicsMagick 1.4 and potentially earlier releases [1].

Exploitation

An attacker can trigger the vulnerability by providing a crafted image file (e.g., a malicious PNG, JPEG, or other supported format) and invoking a conversion to PCX using GraphicsMagick's convert command or equivalent API. No special authentication or network access is required if the attacker can supply the image file to a process that converts it. The bug is reachable through the normal image read-write pipeline without any additional configuration [1].

Impact

A successful exploit causes a heap-buffer-overflow that can corrupt memory, leading to a denial of service (crash) of the GraphicsMagick process. While the referenced advisory demonstrates a write overflow of size 1, the crash is reliably reproducible. Under certain conditions, the overflow might be leveraged for arbitrary code execution, though the reference does not demonstrate this; the primary impact is denial of service [1].

Mitigation

GraphicsMagick version 1.3.36 was released on 2021-06-14 and includes a fix for this issue. Users should upgrade to version 1.3.36 or later. For systems where an immediate upgrade is not feasible, restricting image conversion to trusted sources and avoiding the PCX output format can reduce risk. This vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog [1].