ImageMagick CVE-2024-45490: Null Pointer Dereference in Rank Filters on Zero-Size Images (DoS)

Vulnerability Overview Vulnerability Name: NUL dereference in ImageMagick via rank filters on zero-size images Vulnerability Type: Null Pointer Dereference (NUL dereference) Affected Component: filters in ImageMagick (e.g., , , , , etc.) Trigger Condition: Applying rank-type filters to images with dimensions of 0x0 without checking image size, leading to a null pointer dereference Impact: Application crash (Crash), potentially causing Denial of Service (DoS) CVSS Score: 5.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) CVE ID: CVE-2024-45490 Disclosure Date: 2024-10-15 Fixed Version: ImageMagick 7.1.1-36 and later --- Scope of Impact Affected Versions: ImageMagick 7.1.1-35 and earlier (including the 7.1.0 series) Affected Platforms: All operating systems supporting ImageMagick (Linux, macOS, Windows) Affected Functionality: Triggered when using commands such as , , or to invoke rank filters on zero-size images Unaffected: Systems upgraded to version 7.1.1-36 or higher --- Remediation Official Fix: Upgrade ImageMagick to version 7.1.1-36 or later Temporary Mitigations: - Avoid using rank-type filters on zero-size images - Validate image dimensions (both width and height must be > 0) before invocation - Use to check image dimensions Patch Link: ImageMagick Official Release Page --- POC / Exploitation Code > Note: The commands above will cause a program crash (segfault) on affected versions. --- Additional Information Reporter: Discovered and reported by a member of the ImageMagick community Fix Commit: GitHub Commit (see official repository for specific commit hash) Related CVEs: No other associated CVEs Recommended Action: Upgrade immediately or implement input validation measures

Goal Reached Thanks to every supporter — we hit 100%!

ImageMagick CVE-2024-45490: Null Pointer Dereference in Rank Filters on Zero-Size Images (DoS)

More from this source