ImageMagick Heap Buffer Overflow Vulnerability in YAML and JSON Encoders

A heap buffer overflow vulnerability has been identified in ImageMagick versions prior to 7.1.2-19. This vulnerability occurs in the YAML and JSON output encoders, where a crafted image can cause an out-of-bounds heap write, leading to a crash.

Impact

Exploitation of this vulnerability causes a heap buffer overflow write, which can lead to memory corruption and potentially allow for arbitrary code execution.

Reproduction

The vulnerability can be reproduced by using ImageMagick to process a crafted image that is designed to exploit the YAML or JSON output encoding. This can be done by using the 'magick' command-line tool or through a programming interface that uses ImageMagick, such as Magick.NET. The crafted image should be prepared to trigger the out-of-bounds write when the YAML or JSON output is generated.

Remediation

Users can upgrade to ImageMagick version 7.1.2-19 or later to address this vulnerability.