A memory corruption vulnerability in ImageMagick, stemming from unsafe integer calculations, poses a high risk of system compromise or denial of service.

The vulnerability is an integer overflow (CWE-190) occurring within the ReadOneMNGImage function in coders/png.c. An unauthenticated attacker can trigger this flaw by providing a malicious MNG image, which results in unsafe magnified size calculations and subsequent memory corruption.

A successful exploit allows an attacker to corrupt memory, which may lead to arbitrary code execution or a crash of the affected application. Given the CVSS score of 8.8, this vulnerability is categorized as High, representing a significant threat to services that process user-supplied image files. Organizations relying on ImageMagick for automated image processing face potential data exposure and operational downtime if this flaw is weaponized against their infrastructure.

Immediate Action: Update ImageMagick to version 6.9.13-27 or 7.1.2-1, or apply the corresponding updates for downstream packages such as Magick.NET (version 14.8.0).

Proactive Monitoring: Monitor server logs for unexpected process terminations or crashes related to the ImageMagick binary or its associated libraries.

Compensating Controls: Implement strict input validation and sanitization for all image uploads and ensure that image processing occurs within a restricted, sandboxed environment to limit the impact of memory corruption.

Public Exploit Available: No

Due to the high severity of this memory corruption flaw and the existence of proof-of-concept indicators, immediate patching is required. Security teams should prioritize updating all instances of ImageMagick and dependent software to the specified fixed versions to eliminate the underlying vulnerability and protect against potential remote exploitation.