3.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-pmpg-6pww-fg6q

GHSA-pmpg-6pww-fg6q: ImageMagick has out-of-bounds access in ConnectedComponentsImage() via CLI-controlled connected-components:* artifacts

When the connected-components:* define specifies an invalid index and out of bound operation will result in an access violation.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-pmpg-6pww-fg6q

GHSA-pmpg-6pww-fg6q:

3.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-x86	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-OpenMP-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-x86	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-OpenMP-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-AnyCPU	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-OpenMP-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-x86	nuget	< 14.12.0	14.12.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability advisory GHSA-pmpg-6pww-fg6q explicitly mentions that the out-of-bounds access occurs in the ConnectedComponentsImage() function when processing connected-components:* artifacts. By analyzing the commits between the last vulnerable version (7.1.2-18) and the first patched version (7.1.2-19), I identified the fixing commit 2ab24d74865ab92faeeefe0fec890abf1e88e57c. The patch in this commit is located in the file MagickCore/vision.c and applies changes directly to the ConnectedComponentsImage function. Specifically, the patch adds if conditions to validate the index used to access the object array. This index is derived from the user-controlled connected-components:* artifacts. The absence of these checks in the vulnerable version allowed for an out-of-bounds write, which is the root cause of the vulnerability.

Vulnerable functions

ConnectedComponentsImage

MagickCore/vision.c

The function `ConnectedComponentsImage` is vulnerable to an out-of-bounds write. It processes `connected-components:*` image artifacts which can be controlled by a user. When an invalid index is specified in these artifacts, the function attempts to access an array `object` at an out-of-bounds index, leading to a memory access violation. The patch adds boundary checks to ensure the index `first` is within the valid range of the `object` array before the access occurs.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.