ImageMagick is vulnerable to an Integer Overflow in TIM decoder leading to out of bounds read (32-bit only)

Vulnerability

Overview

The TIM (PSX TIM) image parser in ImageMagick versions 7.1.2-9 and prior contains an integer overflow vulnerability in the ReadTIMImage function within coders/tim.c. The code reads 16-bit width and height values from the file header and calculates image_size = 2 * width * height without any overflow check [2]. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value [2].

Exploitation

Details

The overflow leads to a small heap allocation via AcquireQuantumMemory, as the computed image_size is far smaller than expected. Subsequent operations that rely on the original width and height dimensions can then read beyond the allocated buffer, resulting in an out-of-bounds read [2]. Exploitation requires only the ability to supply a crafted TIM image file; no special authentication or privileges are needed beyond accessing ImageMagick's processing pipeline.

Impact

An attacker can achieve arbitrary memory disclosure through the out-of-bounds read, potentially leaking sensitive information from the process's address space [2]. The vulnerability is limited to 32-bit platforms and is not exploitable on 64-bit systems due to the larger size_t preventing overflow.

Mitigation

The issue is fixed in ImageMagick version 7.1.2-10, which was released on 2025-12-07 [3]. Users should update to the latest version. For environments where immediate patching is not possible, consider using a security policy to restrict or disable TIM file processing, or run ImageMagick on 64-bit systems where the overflow does not occur.