ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder

Root

Cause

ImageMagick, a widely used open-source image processing suite [1], contains a heap over-read vulnerability in its MAT decoder. The issue arises from incorrect parenthesization in arithmetic operations, causing the decoder to use 32-bit arithmetic that can overflow. This leads to an undersized buffer allocation and subsequent heap over-read when processing crafted MAT files [2][4].

Exploitation

The vulnerability can be triggered remotely by supplying a specially crafted MAT image file. No authentication or user interaction is required beyond opening the file, making it exploitable in scenarios where ImageMagick processes user-uploaded images (e.g., web applications). The attack complexity is low, and the attack vector is network [4].

Impact

Successful exploitation results in a heap over-read, potentially disclosing sensitive memory contents (confidentiality high) and causing application crashes (availability high). The CVSS v4.0 base score is 8.2 (High) [4]. Integrity is not affected.

Mitigation

The vulnerability is fixed in ImageMagick versions 7.1.2-16 and 6.9.13-41 [2]. Users should update immediately. The fix is also included in Magick.NET 14.10.4 [3]. No workarounds are documented.