ImageMagick has a heap buffer overflow in WriteXWDImage due to CARD32 arithmetic overflow in bytes_per_line calculation

Root

Cause

A 32-bit unsigned integer overflow in the XWD (X Windows) encoder causes a heap buffer allocation that is too small [2]. When writing an extremely large image, this undersized allocation leads to an out-of-bounds heap write [2]. The flaw is present in ImageMagick versions prior to 7.1.2-16 and 6.9.13-41 [3].

Exploitation

The vulnerability is triggered by providing a specially crafted, extremely large image file to the XWD encoder for processing [2]. Writing such an image causes the overflow, resulting in the buffer under-allocation. No authentication is required if a service or script processes user-supplied images with ImageMagick.

Impact

An attacker can exploit the out-of-bounds heap write to corrupt adjacent memory. This can potentially lead to arbitrary code execution or a denial of service condition by crashing the application. The heap-buffer-overflow was confirmed using AddressSanitizer, demonstrating a write of size 1 past the allocated buffer [3].

Mitigation

The vulnerability has been fixed in ImageMagick versions 7.1.2-16 and 6.9.13-41 [2][3]. Users should update to these patched versions as soon as possible. For systems that cannot be immediately updated, a workaround is to restrict processing of untrusted XWD images through the security policy policy.xml.