VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 3, 2020· Updated Aug 4, 2024

CVE-2020-27764

CVE-2020-27764

Description

ImageMagick prior to 6.9.10-69 uses size_t instead of ssize_t in ApplyEvaluateOperator(), potentially causing out-of-range values and availability impact.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

ImageMagick prior to 6.9.10-69 uses size_t instead of ssize_t in ApplyEvaluateOperator(), potentially causing out-of-range values and availability impact.

Vulnerability

In ImageMagick versions prior to 6.9.10-69, the ApplyEvaluateOperator() function in /MagickCore/statistic.c uses size_t casts instead of ssize_t for bitwise and shift operations (AND, OR, XOR, left shift, right shift) [1][2]. This can lead to out-of-range values when processing a crafted input file [1].

Exploitation

An attacker must provide a specially crafted image file to be processed by ImageMagick. No authentication or special privileges are required; the vulnerability is triggered during normal image processing operations that invoke the ApplyEvaluateOperator() function [1].

Impact

The out-of-range values could potentially cause an application crash or denial of service, affecting availability. Red Hat Product Security marked this as Low severity because no specific impact was demonstrated [1].

Mitigation

The fix was committed in ImageMagick6 commit 3e21bc8a58b4ae38d24c7e283837cc279f35b6a5 [2] and is included in version 6.9.10-69. Users should upgrade to that version or later. Red Hat Enterprise Linux 5, 6, and 7 are out of support scope; Inkscape on RHEL8 is not affected [1].

References
  1. outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  2. https://github.com/ImageMagick/ImageMagick/issues/1735 · ImageMagick/ImageMagick6@3e21bc8

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

40

Patches

0

No patches discovered yet.

Vulnerability mechanics

Synthesis attempt was rejected by the grounding validator. Re-run pending.

References

4

News mentions

0

No linked articles in our index yet.