En resumen
- CVE-2026-25794 es una vulnerabilidad ALTO (CVSS 8.2) que afecta a Magick.NET-Q16-AnyCPU, Magick.NET-Q16-HDRI-AnyCPU, Magick.NET-Q16-HDRI-OpenMP-arm64.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.47%, mayor que el 40.5% de las vulnerabilidades.
- Solución: actualizar a 14.10.3, 7.1.2-15 o posterior.
Description
WriteUHDRImage in coders/uhdr.c uses int arithmetic to compute the pixel buffer size. When image dimensions are large, the multiplication overflows 32-bit int, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out of bounds heap write.
==1575126==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fc382ef3820 at pc 0x5560d31f229f bp 0x7ffe865f9530 sp 0x7ffe865f9520
WRITE of size 8 at 0x7fc382ef3820 thread T0
#0 0x5560d31f229e in WriteUHDRImage coders/uhdr.c:807
NVD description
ImageMagick is free and open-source software used for editing and manipulating digital images. `WriteUHDRImage` in `coders/uhdr.c` uses `int` arithmetic to compute the pixel buffer size. Prior to version 7.1.2-15, when image dimensions are large, the multiplication overflows 32-bit `int`, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out of bounds heap write. Version 7.1.2-15 contains a patch.
Más vulnerabilidades de Magick.NET-Q16-AnyCPU
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free