ImageMagick (WriteBMPImage): 32-bit integer overflow when writing BMP scanline stride → heap buffer overflow

Vulnerability

A 32-bit integer overflow occurs in the BMP encoder's scanline-stride computation (bytes_per_line) when writing BMP files. For a large image width on a 32-bit build, the stride calculation wraps to a small value, but the per-row writer still emits 3 × width bytes for 24-bpp images. This causes the first row to write past its allocated heap buffer, resulting in a heap buffer overflow with attacker-controlled bytes [1][2].

Exploitation

An attacker can exploit this by crafting an image with specific dimensions that trigger the overflow when ImageMagick converts it to BMP. No authentication is required if a service automatically processes user-uploaded images through ImageMagick. Common attack surfaces include web applications that resize or convert images to BMP format [1].

Impact

Successful exploitation grants the attacker a powerful heap corruption primitive, potentially leading to arbitrary code execution. The CVSS score is 9.8 (Critical), indicating high impact on confidentiality, integrity, and availability [2].

Mitigation

The vulnerability is patched in ImageMagick versions 6.9.13-28 and 7.1.2-2. Users on 32-bit builds should update immediately. The fix adds overflow checks in the stride computation and memory allocation (see commit [4]). No workaround is available for affected versions.