VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 4, 2020· Updated Aug 4, 2024

CVE-2020-27770

CVE-2020-27770

Description

A missing check for a zero value of replace_extent in SubstituteString() can cause an integer overflow, leading to application denial-of-service in ImageMagick versions prior to 7.0.8-68.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A missing check for a zero value of `replace_extent` in SubstituteString() can cause an integer overflow, leading to application denial-of-service in ImageMagick versions prior to 7.0.8-68.

Vulnerability

In ImageMagick versions prior to 7.0.8-68, the function SubstituteString() in MagickCore/string.c contains an integer overflow vulnerability. A missing check for a zero value of the replace_extent parameter allows the offset p to overflow when computing a pointer, leading to undefined behavior. This flaw can be triggered by processing a specially crafted input file [1]. Versions before 7.0.8-68 are affected [1].

Exploitation

An attacker needs to provide a crafted input file to an application using a vulnerable version of ImageMagick. No special privileges or network position are required beyond the ability to submit the file for processing. The exploitation relies on the missing check for a zero value in replace_extent, which causes an unsigned integer overflow during string substitution [1].

Impact

Successful exploitation leads to an impact on application availability, likely a crash or denial-of-service condition. The vulnerability does not appear to allow arbitrary code execution or information disclosure based on the available references [1].

Mitigation

The issue is fixed in ImageMagick version 7.0.8-68, released on 2020-12-04. Users should update to this version or later. The upstream fix is available in commit be90a5395695f0d19479a5d46b06c678be7f7927 [1]. For Red Hat Enterprise Linux 5, 6, and 7, the flaw is out of support scope and no fix is provided. Users of those versions should consider upgrading to a supported operating system [1].

References
  1. unsigned offset overflowed at MagickCore/string.c

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

41

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

3

News mentions

0

No linked articles in our index yet.