CVE-2022-32545

Vulnerability

ImageMagick is vulnerable to an out-of-range value of type 'unsigned char' in the PSD image parsing code located in coders/psd.c [1]. This flaw is triggered when crafted or untrusted input is processed, leading to undefined behavior. All versions of ImageMagick containing this code are affected.

Exploitation

An attacker can exploit this vulnerability by supplying a specially crafted PSD file to an application that uses ImageMagick to parse images. No authentication is required if the application processes user-supplied images. The crafted file causes the parser to compute a value outside the representable range of unsigned char, resulting in undefined behavior.

Impact

Successful exploitation leads to a negative impact on application availability, such as a crash or hang, due to undefined behavior. Other consequences, such as memory corruption, are possible but not confirmed in the available references.

Mitigation

Red Hat has closed this issue as WONTFIX, indicating that no patch will be provided [1]. Users should consider using alternative image processing libraries or implementing input validation to reject crafted PSD files. No official fix is available.