ImageMagick contains a critical stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to trigger memory corruption and impact system availability.

This vulnerability involves a stack-based buffer overflow (CWE-121) within the msl.c file, where an excessively long attribute value triggers memory corruption. The flaw is exploitable by an unauthenticated attacker over the network.

The exploitation of this memory corruption vulnerability can lead to unauthorized information disclosure or a complete denial of service for the affected application. Given the CVSS score of 7.4, this represents a significant security risk, especially in environments where ImageMagick processes untrusted user-supplied image files.

Immediate Action: Update ImageMagick to version 7.1.2-15 or 6.9.13-40, or apply the relevant vendor-specific package updates such as Magick.NET version 14.10.3.

Proactive Monitoring: Monitor application logs for segmentation faults, unexpected process crashes, or abnormal memory usage patterns in services that utilize ImageMagick for image processing.

Compensating Controls: Implement strict input validation and sanitization for all image files processed by the application, and utilize a Web Application Firewall to block requests containing suspicious or malformed metadata attributes.

Public Exploit Available: No

Organizations should prioritize patching this vulnerability due to the potential for service disruption and memory corruption. Identify all instances of ImageMagick within the infrastructure and apply the provided updates immediately to ensure the integrity and stability of image processing workflows.