CVE-2022-2719

Vulnerability

In ImageMagick versions prior to 7.1.0-30, a specially crafted file can cause an assertion failure when the WriteImages function is called in MagickWand/operation.c. The failure occurs because the image list is NULL, leading to an assertion check that terminates the process. This affects ImageMagick 7.1.0-29 and earlier [1].

Exploitation

An attacker can exploit this vulnerability by providing a crafted image file to an application that uses ImageMagick and invokes WriteImages. No authentication or special privileges are required if the application processes user-supplied images. The crafted file triggers the assertion failure, causing the application to crash [1].

Impact

Successful exploitation results in a denial of service (DoS) due to the assertion failure. The crash terminates the process, potentially disrupting service availability. There is no indication of information disclosure, data corruption, or remote code execution [1].

Mitigation

The vulnerability is fixed in ImageMagick version 7.1.0-30. Users should upgrade to this version or later. No workarounds are documented. The issue is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog [1].