VYPR
← All advisories
Unrated severityNVD Advisory· Published May 14, 2021· Updated Aug 4, 2024

CVE-2020-27769

CVE-2020-27769

Description

ImageMagick before 7.0.9-0 has a floating-point range error in PosterizeImage() that could cause denial of service.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

ImageMagick before 7.0.9-0 has a floating-point range error in PosterizeImage() that could cause denial of service.

Vulnerability

In ImageMagick versions before 7.0.9-0, the PosterizeImage() function in MagickCore/quantize.c contains a flaw where values outside the range of representable values of type float are used. This can lead to undefined behavior. The issue was reported by Suhwan Song (Seoul National University) and is tracked in the upstream issue tracker [1].

Exploitation

An attacker can trigger this vulnerability by providing a specially crafted image file that, when processed by ImageMagick, causes the out-of-range float values to be used in PosterizeImage(). No authentication or special privileges are required; the attack vector is remote if the application processes user-supplied images. The exact sequence of steps is not detailed, but the patch addresses multiple occurrences in the function [1].

Impact

Red Hat Product Security assessed this as Low severity because, although it could potentially affect application availability (denial of service), no specific impact was demonstrated. There is no evidence of code execution, information disclosure, or privilege escalation [1].

Mitigation

The vulnerability is fixed in ImageMagick version 7.0.9-0. The upstream patch is available at the commit referenced in the bug report [1]. Red Hat has stated that this flaw is out of support scope for Red Hat Enterprise Linux 5, 6, and 7, and that Inkscape is not affected because it no longer uses a bundled ImageMagick in RHEL 8. Users should update to the patched version or apply the patch if using an affected version [1].

References
  1. outside the range of representable values of type 'float' at MagickCore/quantize.c

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

46

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

2

News mentions

0

No linked articles in our index yet.