CVE-2022-1270

Vulnerability

A heap buffer overflow exists in GraphicsMagick's MIFF image parser, specifically in the ReadMIFFImage function within coders/miff.c [1]. The issue occurs when processing a specially crafted MIFF file; the fread operation writes beyond the allocated heap buffer region (686 bytes allocated, write of size 6146) [1]. The bug affects GraphicsMagick version 1.4 snapshot-20220322 and potentially earlier versions; the Gentoo security advisory lists all users of GraphicsMagick prior to version 1.3.38 as impacted [2].

Exploitation

An attacker must provide a malicious MIFF file to a victim or service using GraphicsMagick (e.g., via gm identify or image processing workflows) [1]. No authentication or special privileges are required; the file is processed automatically. The overflow is triggered during blob reading (ReadBlob), causing a heap-buffer-overflow with no user interaction beyond file opening [1].

Impact

Successful exploitation results in heap memory corruption, potentially leading to arbitrary code execution with the privileges of the user running GraphicsMagick [2]. The overflow corrupts adjacent heap data, and the Gentoo advisory rates the worst-case impact as arbitrary code execution [2].

Mitigation

A fix is included in GraphicsMagick version 1.3.38 (released prior to the GLSA), and all users are advised to upgrade to that version or later [2]. For systems unable to upgrade, no workaround is available; users should avoid processing untrusted MIFF files [2].