CVE-2022-44267

Vulnerability

ImageMagick version 7.1.0-49 is vulnerable to a denial of service when parsing a specially crafted PNG image. During operations such as convert, the process may become stuck waiting for stdin input, leading to a hang. The vulnerability resides in the PNG parsing code and is triggered when the image is processed by the software [1].

Exploitation

An attacker can exploit this vulnerability by providing a malicious PNG image to an application or service that uses ImageMagick to process images. No authentication or special privileges are required; the attacker only needs to supply the crafted file. When ImageMagick attempts to parse the image (e.g., during a resize operation), the process enters a state where it waits indefinitely for stdin input, effectively hanging [1].

Impact

Successful exploitation results in a denial of service (DoS) condition. The affected ImageMagick process becomes unresponsive, consuming system resources and potentially preventing legitimate image processing tasks from completing. This impacts availability but does not lead to information disclosure or code execution [1].

Mitigation

No fixed version is explicitly identified in the available references. Users should upgrade to the latest version of ImageMagick (7.1.2-23 as of the reference date) as a precaution, though it is not confirmed that this version includes a patch for CVE-2022-44267. Workarounds include restricting the processing of untrusted PNG images or using a security policy to limit resource usage [1].