ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions

Vulnerability

The IPL decoder in ImageMagick contains a heap buffer over-write vulnerability when reading multiple images that have different dimensions [1][2]. This flaw affects versions prior to 14.13.1 for the Magick.NET packages [2]. The bug occurs within the internal logic of the IPL image format handler when it fails to properly reallocate or validate buffer sizes against varying image dimensions during a multi-image read operation [2][3].

Exploitation

An attacker can trigger this vulnerability by providing a crafted IPL image file that contains multiple frames or sub-images with disparate dimensions [2][3]. No authentication or special privileges are required, as the attack can be performed remotely by enticing a user or automated process to open the malicious image [3]. User interaction may not be required if the image is processed automatically, e.g., in a server-side upload pipeline [3]. The heap over-write occurs when the decoder writes data beyond the allocated buffer boundary during the processing of these differently-sized images [2].

Impact

Successful exploitation could result in arbitrary code execution in the context of the application using ImageMagick [3]. The vulnerability has been assigned a high severity CVSS score, indicating potential for significant impact on confidentiality, integrity, and availability [2][3]. An attacker could leverage this memory corruption to execute arbitrary commands, manipulate image data, or cause a denial of service [2][3].

Mitigation

A fix is available in version 14.13.1 of the ImageMagick NuGet packages, as listed in the GitHub Security Advisory [2]. Users should upgrade to this patched version immediately [2]. As a general precaution, ImageMagick recommends implementing a security policy tailored to your local environment to restrict potentially dangerous operations [1]. There is no indication this CVE has been added to the CISA Known Exploited Vulnerabilities catalog as of the publication date.