ImageMagick Signed Integer Overflow Vulnerability in SIXEL Decoder Allowing Memory Corruption and Denial-of-Service

A signed integer overflow vulnerability has been identified in ImageMagick's SIXEL decoder, prior to versions 7.1.2-15 and 6.9.13-40. This vulnerability allows an attacker to cause memory corruption and denial-of-service by processing a maliciously crafted SIXEL image file. The issue arises during buffer reallocation operations, where pointer arithmetic with signed 32-bit integers can overflow, leading to memory corruption.

Impact

Exploitation of this vulnerability causes memory corruption, which can lead to a denial-of-service condition. Additionally, such memory corruption vulnerabilities can often be exploited to execute arbitrary code under certain conditions.

Remediation

Users can upgrade to ImageMagick versions 7.1.2-15 or 6.9.13-40 to address this vulnerability.