ImageMagick Stack Buffer Overflow Vulnerability in MNG Encoder

A stack buffer overflow vulnerability has been identified in the ImageMagick MNG encoder, present in versions prior to 7.1.2-16 and 6.9.13-41. The vulnerability arises from missing bounds checks, allowing attacker-controlled data to corrupt the stack. This issue has been addressed in the patched versions 7.1.2-16 and 6.9.13-41.

Impact

Exploitation of this vulnerability leads to a stack buffer overflow, allowing for potential arbitrary code execution.

Reproduction

The vulnerability can be reproduced by processing a specially crafted MNG file with an affected version of ImageMagick. The missing bounds checks in the MNG encoder will allow the crafted file to overwrite the stack with attacker-controlled data, triggering the buffer overflow.

Remediation

Users can upgrade to ImageMagick versions 7.1.2-16 or 6.9.13-41 to address this vulnerability.