ImageMagick Heap Information Disclosure Vulnerability in PSD Format Handler

A heap information disclosure vulnerability has been identified in ImageMagick's PSD format handler, affecting versions prior to 7.1.2-15 and 6.9.13-40. The vulnerability arises when the software processes a maliciously crafted PSD file that contains ZIP-compressed layer data. If the decompressed data is smaller than expected, uninitialized heap memory is leaked into the output image. This flaw could lead to the unauthorized exposure of sensitive data from server memory.

Impact

Exploitation of this vulnerability results in the leakage of uninitialized heap memory into the output image, potentially disclosing sensitive information from server memory.

Remediation

Users can upgrade to ImageMagick versions 7.1.2-15 or 6.9.13-40 to address this vulnerability.