Imagemagick: heap-buffer-overflow in pushcharpixel() in quantum-private.h

Vulnerability

A heap-based buffer overflow exists in ImageMagick's PushCharPixel() function in quantum-private.h. The flaw occurs during the processing of TIFF images with the YCbCr photometric interpretation, where the allocated buffer size is insufficient. This affects ImageMagick versions prior to 7.0.10-0 and 6.9.11-0 [1][2].

Exploitation

An attacker must convince a user to open a specially crafted TIFF file using ImageMagick (e.g., via convert). No authentication is required, but user interaction is necessary. The crafted file triggers an out-of-bounds read in PushCharPixel() during the TIFF decoding process, as demonstrated by an AddressSanitizer report [2].

Impact

Successful exploitation results in an application crash, leading to a denial of service. The vulnerability is limited to a heap-buffer-overflow read; no code execution has been demonstrated [1][2].

Mitigation

The issue was fixed in ImageMagick 7.0.10-0 and 6.9.11-0, released on 2020-03-01, by doubling the buffer extent for YCbCr TIFF images [3][4]. Users should update to these or later versions. No workaround is available for unpatched versions.