ImageMagick has a write heap-buffer-overflow in PCL encoder via undersized output buffer

Vulnerability

Overview

A heap-buffer-overflow vulnerability exists in the PCL (Printer Control Language) encoder of ImageMagick, a widely used open-source image processing suite. The root cause is an undersized output buffer allocation during PCL encoding, which can lead to writing beyond the allocated memory region [2]. This issue affects versions prior to 7.1.2-16 and 6.9.13-41 [1].

Exploitation

An attacker can trigger this vulnerability by providing a specially crafted image file that, when processed by ImageMagick's PCL encoder, causes a write beyond the bounds of the allocated heap buffer. The attack vector is network-based, with low complexity and no privileges required, but user interaction is needed (e.g., opening the malicious file) [4]. The vulnerability can be exploited remotely if the attacker can deliver the crafted image to a system using ImageMagick.

Impact

Successful exploitation could lead to memory corruption, potentially allowing an attacker to cause a denial of service crash or, in some scenarios, achieve arbitrary code execution. The CVSS assessment indicates potential impacts on confidentiality, integrity, and availability [4].

Mitigation

The vulnerability is fixed in ImageMagick versions 7.1.2-16 and 6.9.13-41 [2]. Users should update to these versions or later. The fix is also included in downstream libraries such as Magick.NET 14.10.4 [3]. No workarounds are documented for unpatched versions.