ImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code execution

This vulnerability is a format string bug in ImageMagick's InterpretImageFilename function. The function directly passes user-controlled input containing format specifiers like %d, %o, or %x to FormatLocaleString without sanitization [1][2]. This allows an attacker to supply a crafted filename that, when processed, treats parts of the input as format string arguments, leading to arbitrary memory writes [1].

Attack

Vector An attacker can exploit this by providing a malicious image filename to an application using ImageMagick. The vulnerability is triggered during image file processing when the InterpretImageFilename function parses the filename [1]. No authentication is required if the application processes attacker-supplied filenames [1]. The attack surface includes any service or tool that uses ImageMagick to handle user-provided image paths or filenames.

Impact

Successful exploitation enables an attacker to overwrite arbitrary memory regions [1]. This can lead to heap overflow, corruption of critical data structures, and ultimately remote code execution (RCE) in the context of the vulnerable process [1][2]. The severity is high due to the potential for complete system compromise.

The fix is included in ImageMagick versions 6.9.13-28 and 7.1.2-2 [1][2]. The patch introduces proper validation of format specifiers in the filename [4]. Users should upgrade to the patched versions immediately [1].