VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 8, 2020· Updated Aug 4, 2024

CVE-2020-25676

CVE-2020-25676

Description

ImageMagick prior to 7.0.9-0 contains multiple out-of-range and integer overflow issues in pixel offset calculations, exploitable via crafted input files.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

ImageMagick prior to 7.0.9-0 contains multiple out-of-range and integer overflow issues in pixel offset calculations, exploitable via crafted input files.

Vulnerability

In ImageMagick versions prior to 7.0.9-0, the functions CatromWeights(), MeshInterpolate(), InterpolatePixelChannel(), InterpolatePixelChannels(), and InterpolatePixelInfo() in /MagickCore/pixel.c contain multiple unconstrained pixel offset calculations used with the floor() function. These calculations produce undefined behavior in the form of out-of-range errors and integer overflows, as identified by UndefinedBehaviorSanitizer [1].

Exploitation

An attacker who can supply a crafted input file to be processed by ImageMagick can trigger these instances of undefined behavior. No special network position or authentication is required beyond the ability to provide a malicious file for processing [1].

Impact

The undefined behavior caused by these out-of-range and integer overflow issues could impact application availability or potentially cause other problems related to undefined behavior. The exact impact depends on compiler optimizations and runtime behavior when undefined operations occur [1].

Mitigation

ImageMagick version 7.0.9-0 and later contain the fixes for these issues. Users should upgrade to at least version 7.0.9-0 [1]. No workaround or other mitigation has been disclosed in the available references.

References
  1. outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c and MagickCore/cache.c

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

40

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

3

News mentions

0

No linked articles in our index yet.