VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 3, 2020· Updated Aug 4, 2024

CVE-2020-27763

CVE-2020-27763

Description

A division-by-zero vulnerability in ImageMagick's resize.c (before 7.0.8-68) can cause application crashes when processing crafted files.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A division-by-zero vulnerability in ImageMagick's resize.c (before 7.0.8-68) can cause application crashes when processing crafted files.

Vulnerability

A flaw in ImageMagick, specifically in the MagickCore/resize.c file, can trigger a division-by-zero operation. An attacker who submits a specially crafted file that is processed by ImageMagick could cause undefined behavior. This vulnerability affects all versions of ImageMagick prior to 7.0.8-68 [1].

Exploitation

Exploitation requires the attacker to supply a malicious file to an application that uses ImageMagick to process images. No authentication or special network position is needed, as the file can be delivered through common vectors such as email attachments, web uploads, or downloaded content. The vulnerable code path executes division operations on data derived from the image without proper validation, leading to division by zero.

Impact

Successful exploitation leads to undefined behavior, most likely resulting in a denial of service (application crash) due to the arithmetic exception [1]. While the primary impact is on availability, the description notes that division by zero could potentially cause other undefined behavior, though this is not further elaborated in the available references.

Mitigation

The vulnerability is fixed in ImageMagick version 7.0.8-68 as noted in the bug report [1]. Users should update to this version or later. For Red Hat Enterprise Linux, versions 5, 6, and 7 are out of support scope and may not receive patches; Inkscape on RHEL8 uses a different library and is not affected [1]. No other workarounds are mentioned in the references.

References
  1. division by zero at MagickCore/resize.c

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

42

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

3

News mentions

0

No linked articles in our index yet.