ImageMagick vulnerable to denial of service via integer overflow in BMP decoder on 32-bit systems

Vulnerability

An integer overflow vulnerability exists in ImageMagick's BMP decoder (coders/bmp.c) on 32-bit systems. The bug occurs when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions (e.g., width 536,870,912 and 32 bits per pixel) causes this multiplication to overflow and wrap to zero [2][3]. This results in a bytes_per_line calculation of zero, leading to insufficient memory allocation.

Exploitation

Exploitation requires a 32-bit build of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults [2][3]. A specially crafted 58-byte BMP file can trigger the overflow. The patch originally added for CVE-2025-57803 (BMPOverflowCheck) is ineffective because it checks the result of the multiplication after the overflow has already occurred [2].

Impact

Successful exploitation can cause a denial of service, including AddressSanitizer crashes, as the zero bytes_per_line leads to improper memory access [2]. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default resource limits are not affected.

Mitigation

The vulnerability is fixed in ImageMagick versions 7.1.2-7 and 6.9.13-32 [2][3]. The fix corrects the overflow check placement. Users of 32-bit systems with custom resource limits should update immediately. Magick.NET released version 14.9.0 incorporating the fix [4].