ImageMagick has a heap Buffer Over-read in its DJVU image format handler

A heap buffer over-read vulnerability exists in ImageMagick's DJVU image format handler, affecting versions prior to 7.1.2-15 and 6.9.13-40. The flaw is caused by integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, leading to an out-of-bounds memory read condition [1].

Exploitation requires processing a specially crafted DJVU file. The vulnerability is triggered during image decoding when the stride calculation overflows, causing the buffer allocation to be undersized. This allows an attacker to cause the decoder to read memory beyond the allocated buffer bounds. No authentication is required, as the attack vector is remote through file parsing [1][4].

A successful exploit could result in information disclosure via out-of-bounds memory reads, potentially leaking sensitive data from adjacent heap memory. The vulnerability does not directly allow code execution, but memory corruption may lead to other impacts depending on the application's usage [1].

Both ImageMagick 7.1.2-15 and 6.9.13-40 contain a patch that corrects the stride calculation to prevent integer overflow. Users are strongly advised to update to these patched versions. The issue is also tracked as GitHub Security Advisory GHSA-r99p-5442-q2x2 [1][3][4].