CVE-2022-28463

Vulnerability

ImageMagick 7.1.0-27 is vulnerable to a heap-buffer-overflow in the PushLongPixel function located in quantum-private.h. The issue is triggered when decoding crafted CIN image files. The CIN decoder reads the image_offset field from the file header without proper validation. If image_offset is less than 712 bytes, the subsequent read operations access heap memory outside the allocated buffer, leading to a buffer overflow. This vulnerability is documented in the ImageMagick issue #4988 and affects version 7.1.0-27 [1][2][3].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious CIN image file with an image_offset value below 712. The victim must open the crafted image using ImageMagick (e.g., via an application that processes user-supplied images). No authentication or special privileges are required. The overflow occurs during the import of pixel data, allowing the attacker to read out-of-bounds heap data [1].

Impact

Successful exploitation can result in information disclosure of heap memory contents, potentially revealing sensitive data. Under certain conditions, the attacker might achieve arbitrary code execution by controlling the data read from out-of-bounds memory, leading to a full system compromise. The vulnerability has high severity due to the potential for remote code execution [1][2][3].

Mitigation

The vulnerability is fixed in upstream commits ca3654e for ImageMagick 7 and e6ea587 for ImageMagick 6. Users should update to the latest patched versions or apply the workaround by ensuring that any CIN image processed has an image_offset of at least 712 bytes. No known exploitation in the wild has been reported as of the publication date [2][3].