A critical integer overflow vulnerability in ImageMagick allows unauthenticated remote attackers to cause application crashes, leading to a denial of service.

This vulnerability stems from an off-by-one boundary check error during the processing of SVG files, which leads to an integer overflow and an undefined size_t cast. The vulnerability is remotely exploitable by an unauthenticated attacker who provides a specially crafted image file to the application.

Successful exploitation of this vulnerability results in a denial of service, which can render image processing workflows or web applications utilizing the ImageMagick library unavailable. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to service availability and system stability. Organizations relying on ImageMagick for automated document or image processing are particularly vulnerable to disruption.

Immediate Action: Update ImageMagick to version 7.1.2-15 or 6.9.13-40, or apply the latest patches provided by your specific distribution or package manager, such as Magick.NET version 14.10.3 for NuGet users.

Proactive Monitoring: Monitor system logs for abnormal termination of image processing services or unexpected CPU usage spikes that may indicate an attempt to trigger an overflow condition.

Compensating Controls: Implement input validation or restrict the types of files processed by ImageMagick to only those from trusted sources, and utilize a Web Application Firewall to detect and block malformed SVG uploads.

Public Exploit Available: Unknown.

Given the ease of remote exploitation and the potential for service disruption, administrators should prioritize patching their ImageMagick installations. Ensure that all downstream dependencies, such as language-specific wrappers like Magick.NET, are also updated to their respective fixed versions to prevent continued exposure.