Imagemagick Has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer
概要
Imagemagick Has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the UIL and XPM image encoder do not validate the pixel index value returned by GetPixelIndex() before using it as an array subscript. In HDRI builds, Quantum is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2026-25898 imagemagick 修正版: 8:6.9.11.60+dfsg-1.3+deb11u10
- Ubuntu UBUNTU-CVE-2026-25898 imagemagick 修正版: 8:6.7.7.10-6ubuntu3.13+esm19
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov