VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 4, 2020· Updated Aug 4, 2024

CVE-2020-27772

CVE-2020-27772

Description

A flaw in ImageMagick's BMP encoder causes undefined behavior via out-of-range unsigned int values, potentially leading to denial of service.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A flaw in ImageMagick's BMP encoder causes undefined behavior via out-of-range unsigned int values, potentially leading to denial of service.

Vulnerability

A flaw exists in ImageMagick's WriteBMPImage() function in coders/bmp.c. Numerous RGB and gamma calculations can produce values outside the range of type unsigned int, triggering undefined behavior. This affects ImageMagick versions prior to 7.0.9-0 [1].

Exploitation

An attacker can exploit this by submitting a crafted BMP file that, when processed by ImageMagick, triggers the out-of-range calculations. No authentication is required if the application processes user-supplied images. The crafted file must be written via the BMP encoder, which occurs during image conversion or saving operations [1].

Impact

The undefined behavior most likely leads to an application crash, impacting availability. While other undefined behavior consequences are possible, no specific impact beyond denial of service has been demonstrated. Red Hat Product Security rated this as Low severity [1].

Mitigation

The issue is fixed in ImageMagick version 7.0.9-0. For Red Hat Enterprise Linux 5, 6, and 7, this flaw is out of support scope. Fedora and EPEL have tracking bugs for the fix. As a workaround, avoid processing untrusted BMP files with affected versions until patched [1].

References
  1. outside the range of representable values of type 'unsigned int' at coders/bmp.c

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

42

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"Integer arithmetic in WriteBMPImage() overflows unsigned int, causing undefined behavior."

Attack vector

An attacker supplies a crafted BMP file that, when processed by ImageMagick, triggers undefined behavior in `WriteBMPImage()` due to integer arithmetic that overflows the `unsigned int` type [ref_id=1]. The advisory notes that while the most likely impact is denial of service (application availability), other consequences of undefined behavior cannot be ruled out [ref_id=1]. No authentication or special network position is required beyond delivering the malicious file to a victim or service that uses ImageMagick.

Affected code

The flaw resides in `WriteBMPImage()` within `coders/bmp.c`. Numerous RGB and gamma calculations in that function can produce values that exceed the range of `unsigned int`, leading to undefined behavior. The patch addresses 12 such locations by casting operands to `ssize_t`.

What the fix does

The patch modifies 12 arithmetic expressions in `WriteBMPImage()` by casting intermediate values to `ssize_t`, which is a signed type with a larger range. This prevents the overflow that caused values to fall outside the representable range of `unsigned int`, thereby eliminating the undefined behavior. The fix does not alter the logic of the calculations, only the type width used during evaluation.

Preconditions

  • inputThe victim or service must process a crafted BMP file using ImageMagick.
  • authNo authentication or special privileges are required beyond file delivery.

Generated on May 31, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

3

News mentions

0

No linked articles in our index yet.