Listen to this Post
The vulnerability arises from an integer overflow when parsing PlayStation TIM image files on 32‑bit systems. In the `ReadTIMImage` function (located in coders/tim.c), the code reads two 16‑bit values from the file header—width and height. It then calculates the amount of memory to allocate using the expression image_size = 2 width height. This calculation is performed without any overflow checks. On a 64‑bit platform, `size_t` is 64‑bit, so the multiplication can safely handle large values. However, on a 32‑bit platform, `size_t` is only 32‑bit and has a maximum value of 4,294,967,295. An attacker can supply `width = 46341` and height = 46341. The product `2 46341 46341` equals approximately 4,294,985,802, which exceeds the 32‑bit limit. This causes the value to wrap around to a very small number, effectively under‑allocating the heap buffer. When the image data is later copied into this buffer, the write operation overruns the allocated memory, leading to a heap‑based out‑of‑bounds write. This typically results in a crash, but can be further exploited to achieve arbitrary code execution.
DailyCVE Form
Platform: `ImageMagick`
Version: `7.1.2-9`
Vulnerability: `Integer overflow`
Severity: `High (7.5)`
Date: `2025‑12‑10`
Prediction: `Already patched`
What Undercode Say
The following commands and code snippets illustrate how the vulnerability can be triggered and analyzed:
Clone the ImageMagick repository to examine the vulnerable code git clone https://github.com/ImageMagick/ImageMagick.git cd ImageMagick/coders View the vulnerable function (ReadTIMImage) around lines 30-40 grep -n "image_size = 2 \ width \ height" tim.c
// Vulnerable code snippet from coders/tim.c width = ReadBlobLSBShort(image); // 2 bytes height = ReadBlobLSBShort(image); // 2 bytes // No overflow check image_size = 2 width height; // 32‑bit multiplication pixels = (unsigned char ) AcquireQuantumMemory(image_size, sizeof(pixels));
How Exploit
An attacker crafts a malicious TIM image file with `width = 46341` and height = 46341. When this file is opened by a vulnerable version of ImageMagick on a 32‑bit system, the `image_size` calculation wraps around to a small number. The subsequent memory copy writes beyond the allocated buffer, causing a crash or potentially allowing arbitrary code execution. The attack is remote and requires no user interaction beyond opening the crafted file.
Protection from this CVE
- Upgrade to ImageMagick version 7.1.2‑10 or later, where the overflow check has been added.
- If upgrading is not immediately possible, compile ImageMagick for 64‑bit platforms only.
- Use a security module like AppArmor or SELinux to restrict the application’s memory access.
- Employ input validation in wrapper scripts to reject TIM files with suspicious dimensions.
Impact
Successful exploitation leads to an out‑of‑bounds heap write, which can cause a denial of service (application crash). Under controlled conditions, the overflow can be leveraged for remote code execution, potentially compromising the entire system. The CVSS score is 7.5 (High), reflecting the high attack complexity but the potential for severe damage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
