CVE-2020-27752: Buffer Overflow
A flaw was found in ImageMagick in MagickCore/quantum-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger a heap buffer overflow. This would most likely lead to an impact to application availability, but could potentially lead to an impact to data integrity as well. This flaw affects ImageMagick versions prior to 7.0.9-0.
Other sources
In ImageMagick, there is a heap-buffer-overflow at MagickCore/quantum-private.h:227 in PopShortPixel.
Reference: https://github.com/ImageMagick/ImageMagick/issues/1752
Upstream patch: https://github.com/ImageMagick/ImageMagick/commit/a9d563d3d73874312080d30dc4ba07cecad56192
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-27752?
CVE-2020-27752 is a vulnerability found in ImageMagick that allows an attacker to trigger a heap buffer overflow by submitting a crafted file.
What is the severity of CVE-2020-27752?
The severity of CVE-2020-27752 is high with a CVSS score of 7.1.
Which versions of ImageMagick are affected by CVE-2020-27752?
ImageMagick versions up to 6.9.11-47 and versions between 7.0.0-0 and 7.0.9-0 are affected by CVE-2020-27752.
How can an attacker exploit CVE-2020-27752?
An attacker can exploit CVE-2020-27752 by submitting a specially crafted file that triggers a heap buffer overflow in ImageMagick.
Are there any fixes available for CVE-2020-27752?
Yes, fixes for CVE-2020-27752 are available. It is recommended to update to a patched version of ImageMagick.