VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 4, 2020· Updated Aug 4, 2024

CVE-2020-27765

CVE-2020-27765

Description

A division by zero vulnerability in ImageMagick's segment.c allows attackers to cause denial of service via crafted files.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A division by zero vulnerability in ImageMagick's segment.c allows attackers to cause denial of service via crafted files.

Vulnerability

A flaw exists in ImageMagick's MagickCore/segment.c where processing a specially crafted file can trigger a division by zero, leading to undefined behavior. This affects ImageMagick versions prior to 7.0.9-0. The vulnerability is reachable when ImageMagick processes user-supplied images, such as through web uploads or automated pipelines [1].

Exploitation

An attacker can exploit this vulnerability by submitting a crafted image file to an application or service that uses ImageMagick to process it. No authentication or special privileges are required; the attacker only needs the ability to provide a malicious file that triggers the division by zero in the segment.c code path [1].

Impact

Successful exploitation most likely results in a denial of service (application crash) due to undefined behavior from the division by zero. While the primary impact is on availability, other unpredictable consequences could occur depending on the compiler and runtime environment [1].

Mitigation

The vulnerability is fixed in ImageMagick version 7.0.9-0 and later. Users should upgrade to this version or newer. For Red Hat Enterprise Linux 5, 6, and 7, this issue is out of support scope; Inkscape on RHEL 8 is not affected as it no longer bundles a vulnerable ImageMagick [1].

References
  1. division by zero at MagickCore/segment.c

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

43

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

3

News mentions

0

No linked articles in our index yet.