VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 4, 2020· Updated Aug 4, 2024

CVE-2020-27775

CVE-2020-27775

Description

ImageMagick prior to 7.0.9-0 has undefined behavior in quantum.h when processing crafted files, potentially leading to denial of service.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

ImageMagick prior to 7.0.9-0 has undefined behavior in quantum.h when processing crafted files, potentially leading to denial of service.

Vulnerability

A flaw exists in ImageMagick's MagickCore/quantum.h where values outside the range of type unsigned char can occur when processing a crafted file. This undefined behavior affects ImageMagick versions prior to 7.0.9-0 [1].

Exploitation

An attacker can trigger this vulnerability by submitting a specially crafted file to be processed by ImageMagick. No authentication or special privileges are required if the application accepts user-supplied images. The undefined behavior occurs during the processing of the file [1].

Impact

The undefined behavior could lead to an impact on application availability, potentially causing a denial of service. While other problems related to undefined behavior are possible, no specific impact beyond availability was demonstrated in this case. Red Hat Product Security rated this as Low severity [1].

Mitigation

The issue is fixed in ImageMagick version 7.0.9-0, with the upstream patch available at commit a2166bfb1049bac4c0f7b8b5d3ef86a1f48470b2 [1]. Users should upgrade to the patched version. For Red Hat Enterprise Linux 5, 6, and 7, this flaw is out of support scope; Inkscape on RHEL 8 is not affected as it no longer uses a bundled ImageMagick [1].

References
  1. outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

43

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

3

News mentions

0

No linked articles in our index yet.