VYPR
← All advisories
Unrated severityNVD Advisory· Published Apr 12, 2023· Updated Feb 10, 2025

CVE-2023-1906

CVE-2023-1906

Description

Heap-based buffer overflow in ImageMagick's ImportMultiSpectralQuantum() allows denial of service via crafted file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Heap-based buffer overflow in ImageMagick's ImportMultiSpectralQuantum() allows denial of service via crafted file.

Vulnerability

A heap-based buffer overflow vulnerability exists in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An attacker can trigger an out-of-bounds read by providing a specially crafted file to the convert utility. This issue affects versions prior to the fix, including those shipped in Fedora and EPEL-8 [1]. RHEL-6 and RHEL-7 are not affected as the vulnerable code is not present [1].

Exploitation

No authentication is required; the attacker only needs to convince a user to process a malicious file with ImageMagick. The crafted file, when parsed, causes the ImportMultiSpectralQuantum() to read beyond the allocated heap buffer, leading to a crash.

Impact

Successful exploitation results in a denial of service (DoS) due to application crash. No code execution or privilege escalation has been reported; the impact is limited to availability loss.

Mitigation

The issue is fixed in commit d7a8bdd [4]. Users should update ImageMagick to a version containing this patch. Red Hat has acknowledged the issue for Fedora and EPEL-8; updates may be available through respective package managers [1]. No workarounds are documented.

References
  1. heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  2. possible heap buffer overflow (https://github.com/ImageMagick/ImageMa… · ImageMagick/ImageMagick@d7a8bdd

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

6

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"A heap-based buffer overflow occurs in the ImportMultiSpectralQuantum() function due to improper handling of input data."

Attack vector

An attacker can trigger this vulnerability by providing a specially crafted file to the `convert` utility. This crafted file will cause an out-of-bounds read error within the ImportMultiSpectralQuantum() function. This error can lead to an application crash, resulting in a denial of service.

Affected code

The vulnerability resides in the ImportMultiSpectralQuantum() function, located in the file MagickCore/quantum-import.c. This function is responsible for importing multi-spectral quantum data and is where the out-of-bounds read error is triggered.

What the fix does

The advisory indicates that the issue has been addressed in ImageMagick versions 6.9.12-84 and 7.1.1-6. Users are strongly advised to update their ImageMagick installations to these patched versions to mitigate the risk. The exact code changes are not detailed in the provided information, but updating to the specified versions is the recommended remediation.

Preconditions

  • inputThe attacker must be able to provide a specially crafted file to the ImageMagick `convert` utility.

Generated on Jun 8, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.