VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 4, 2020· Updated Aug 4, 2024

CVE-2020-27767

CVE-2020-27767

Description

ImageMagick prior to 7.0.9-0 in MagickCore/quantum.h can trigger undefined behavior via crafted files, leading to application availability impact.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

ImageMagick prior to 7.0.9-0 in MagickCore/quantum.h can trigger undefined behavior via crafted files, leading to application availability impact.

Vulnerability

In ImageMagick versions prior to 7.0.9-0, a flaw exists in MagickCore/quantum.h. Processing a crafted image file can cause values outside the range of types float and unsigned char, resulting in undefined behavior. This can be triggered by an attacker submitting a specially crafted file for processing [1].

Exploitation

An attacker requires the ability to submit a crafted file to ImageMagick for processing. No special privileges or user interaction beyond normal processing of the file is needed. The undefined behavior arises during handling of pixel quantum data, likely due to out-of-bounds or type conversion issues in the quantum handling code [1].

Impact

The primary impact is on application availability, as the undefined behavior can lead to crashes or unpredictable program termination. The Red Hat report states that no specific impact beyond availability was demonstrated, but other consequences of undefined behavior (e.g., memory corruption) could theoretically occur [1]. The severity is rated Low by Red Hat Product Security [1].

Mitigation

The issue is fixed in ImageMagick version 7.0.9-0. Users should upgrade to this version or later. Red Hat Enterprise Linux 5, 6, and 7 are out of support scope; Inkscape on RHEL 8 uses its own bundled ImageMagick and is not affected. No other workarounds are documented [1].

References
  1. outside the range of representable values of type 'float' at MagickCore/quantum.h

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

42

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

3

News mentions

0

No linked articles in our index yet.