VYPR
← All advisories
Unrated severityNVD Advisory· Published Feb 23, 2021· Updated Aug 4, 2024

CVE-2020-27768

CVE-2020-27768

Description

An unsigned integer overflow in ImageMagick's quantum-private.h can cause undefined behavior; fixed in version 7.0.9-0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

An unsigned integer overflow in ImageMagick's quantum-private.h can cause undefined behavior; fixed in version 7.0.9-0.

Vulnerability

In ImageMagick versions prior to 7.0.9-0, the file MagickCore/quantum-private.h contains code that can produce a value outside the representable range of type unsigned int, leading to an integer overflow. This flaw affects all versions before the patched release [1]. The issue was discovered by Suhwan Song (Seoul National University) [1].

Exploitation

The vulnerability is reachable when processing crafted image files that trigger the affected code path. An attacker would need to supply a malicious image to be processed by ImageMagick. No special privileges or authentication are required beyond the ability to provide input to the software [1]. The exact exploitation sequence involves triggering the overflow through specific pixel data or quantum manipulations.

Impact

While the overflow can result in undefined behavior, the most likely outcome is a denial of service (application crash). Red Hat Product Security assessed the severity as Low because although it could potentially impact availability, no concrete impact (such as arbitrary code execution) was demonstrated in this case [1].

Mitigation

The fix was committed upstream in commit 95d4e94e0353e503b71a53f5e6fad173c7c70c90 [1]. The patched version is 7.0.9-0 [1]. Users should update to this version or later. For Red Hat Enterprise Linux 5, 6, and 7, this flaw is out of support scope [1]. Inkscape on RHEL 8 is not affected because it no longer uses a bundled ImageMagick [1].

References
  1. outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

46

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"Missing bounds checking in MagickCore/quantum-private.h allows an unsigned int to exceed its representable range."

Attack vector

An attacker can trigger this bug by providing a crafted image file that causes an arithmetic or conversion operation in `quantum-private.h` to produce a value outside the representable range of `unsigned int`. This could lead to undefined behavior, potentially resulting in a denial of service. The advisory notes that no specific impact was demonstrated, but the flaw could affect application availability [ref_id=1].

Affected code

The vulnerability is located in `MagickCore/quantum-private.h` in ImageMagick. The flaw involves an out-of-range representable value of type `unsigned int` within that header file. The patch commit is `95d4e94e0353e503b71a53f5e6fad173c7c70c90`.

What the fix does

The patch commit `95d4e94e0353e503b71a53f5e6fad173c7c70c90` addresses the out-of-range value by adding proper bounds checking or clamping in `MagickCore/quantum-private.h`. The fix ensures that values remain within the representable range of `unsigned int`, preventing undefined behavior that could lead to application crashes or other availability impacts.

Preconditions

  • inputThe attacker must supply a crafted image file to ImageMagick that triggers the out-of-range unsigned int condition.

Generated on May 31, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

3

News mentions

0

No linked articles in our index yet.