CVE-2022-32547

Vulnerability

In ImageMagick versions prior to 7.1.0-30, the MagickCore/property.c file contains code that performs loads of misaligned addresses for types double (requiring 8-byte alignment) and float (requiring 4-byte alignment). This occurs when processing crafted or untrusted input, leading to undefined behavior [1].

Exploitation

An attacker can provide a specially crafted image file that triggers the misaligned memory access when processed by ImageMagick. No authentication is required if the attacker can deliver the file to a user or service using ImageMagick. The exploitation does not require special network position beyond the ability to supply the input [1].

Impact

Successful exploitation can cause undefined behavior, potentially leading to application crashes or other unpredictable outcomes. The primary impact is on availability, as the vulnerability can cause denial of service. Other impacts may include information disclosure or further memory corruption depending on the specific undefined behavior [1].

Mitigation

The issue is fixed in ImageMagick version 7.1.0-30 [1]. Users should upgrade to this version or later. If upgrading is not possible, consider avoiding processing untrusted images with vulnerable versions.