Imagemagick Has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer
Résumé
Imagemagick Has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer
Description d'origine
La description telle que publiée par la source (souvent en anglais).
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the UIL and XPM image encoder do not validate the pixel index value returned by GetPixelIndex() before using it as an array subscript. In HDRI builds, Quantum is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2026-25898 imagemagick Corrigé dans: 8:6.9.11.60+dfsg-1.3+deb11u10
- Ubuntu UBUNTU-CVE-2026-25898 imagemagick Corrigé dans: 8:6.7.7.10-6ubuntu3.13+esm19
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov