VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 3, 2020· Updated Aug 4, 2024

CVE-2020-27762

CVE-2020-27762

Description

ImageMagick prior to 7.0.8-68 has undefined behavior due to values outside range of unsigned char in WriteHDRImage, potentially leading to denial of service.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

ImageMagick prior to 7.0.8-68 has undefined behavior due to values outside range of unsigned char in WriteHDRImage, potentially leading to denial of service.

Vulnerability

The flaw resides in coders/hdr.c in ImageMagick, specifically in the WriteHDRImage() function. The function attempts to assign pixel color values to unsigned char variables without proper range checking, leading to values outside the representable range of unsigned char. This undefined behavior can be triggered when a crafted input file is processed by ImageMagick. Affected versions are prior to ImageMagick 7.0.8-68 [1].

Exploitation

An attacker needs to submit a crafted HDR image file that, when processed by ImageMagick, causes the WriteHDRImage() function to assign out-of-range values. No special authentication or network position is required beyond the ability to deliver the file for processing.

Impact

The most likely impact is application availability (denial of service), as undefined behavior often leads to crashes. Depending on the compiler and environment, other unpredictable behavior may occur. The severity is considered Low because no concrete impact was demonstrated beyond potential availability issues [1].

Mitigation

The fix was included in ImageMagick version 7.0.8-68. Users should upgrade to this version or later. For Red Hat Enterprise Linux 5, 6, and 7, this flaw is considered out of support scope. Inkscape is not affected because it no longer uses a bundled ImageMagick in RHEL 8 [1].

References
  1. outside the range of representable values of type 'unsigned char' at coders/hdr.c

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

40

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"Missing range check on pixel color values before assignment to unsigned char in WriteHDRImage()."

Attack vector

An attacker crafts a malicious HDR image file containing pixel color values that exceed the range of `unsigned char`. When ImageMagick processes this file via `WriteHDRImage()`, the out-of-range assignment triggers undefined behavior. The attack requires no authentication and is delivered over the network by tricking a user or service into processing the crafted file. [ref_id=1]

Affected code

The flaw resides in `WriteHDRImage()` in `coders/hdr.c`. The function attempts to assign pixel color values to `unsigned char` variables without ensuring they stay within the representable range, leading to undefined behavior. [ref_id=1]

What the fix does

The patch adds checks to ensure pixel values are clamped to the valid range of `unsigned char` before assignment. This prevents undefined behavior by guaranteeing that values outside the representable range are never written. [ref_id=1]

Preconditions

  • inputThe attacker must supply a crafted HDR image file with pixel values outside the unsigned char range.
  • configImageMagick must invoke WriteHDRImage() on the crafted file.

Generated on May 31, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

3

News mentions

0

No linked articles in our index yet.