Imagemagick Has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer

Vulnerability

Overview

The vulnerability resides in the UIL and XPM image encoders in ImageMagick. These encoders do not validate the pixel index value returned by GetPixelIndex() before using it as an array subscript. In HDRI (High Dynamic Range Imaging) builds, the Quantum type is a floating-point number, so pixel index values can be negative. [1][2][4]

Exploitation

An attacker can craft a malicious image file that contains negative pixel index values. When ImageMagick processes this image for conversion (e.g., converting to UIL or XPM format), the encoder uses the negative index as an array subscript, resulting in a global buffer over-read (out-of-bounds read). [2][4] The issue affects both the UIL encoder (at coders/uil.c:355) and the XPM encoder (at coders/xpm.c:1135). [4]

Impact

The out-of-bounds read can lead to information disclosure by reading adjacent memory, potentially exposing sensitive data. It can also cause a process crash, leading to denial of service. No special privileges are needed; the attacker only needs to provide a crafted image file to a user or service that processes images with ImageMagick. [2][4]

Mitigation

The vulnerability is fixed in ImageMagick versions 7.1.2-15 and 6.9.13-40. Users should upgrade to these patched versions. The issue is also tracked as GHSA-vpxv-r9pg-7gpr and was included in the Magick.NET 14.10.3 release. [3][4]