3.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-q8h3-jv9v-57qx

GHSA-q8h3-jv9v-57qx: ImageMagick has has an off-by-one origin validation in allows out-of-bounds read in morphology processing

An incorrect morphology would allow an out of bounds read of a single pixel.

==1200284==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5100000002d0 at pc 0x59e28e60c27a bp 0x7fff047fd8e0 sp 0x7fff047fd8d0
READ of size 4 at 0x5100000002d0 thread T0

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-q8h3-jv9v-57qx

GHSA-q8h3-jv9v-57qx:

3.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-x86	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-OpenMP-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-x86	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-OpenMP-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-AnyCPU	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-OpenMP-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-x86	nuget	< 14.12.0	14.12.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an out-of-bounds read in ImageMagick's morphology processing, caused by an off-by-one error in origin validation. The provided security advisory GHSA-q8h3-jv9v-57qx pointed to a patch that fixes this issue. By analyzing the commits between the last vulnerable version and the first patched version, the specific fixing commit was identified. The commit a6bfb1bb7b4017ec52f5a957641d83ce29b63286 modifies the AcquireKernelBuiltIn function in MagickCore/morphology.c. The patch clearly shows the change from a > to a >= in a boundary check, which is a classic off-by-one error fix. This confirms that AcquireKernelBuiltIn is the vulnerable function where user-controlled input could lead to an out-of-bounds read.

Vulnerable functions

AcquireKernelBuiltIn

MagickCore/morphology.c

The vulnerability is an off-by-one error in the boundary check within the `AcquireKernelBuiltIn` function. The original code used a `>` comparison, allowing `args->xi` to be equal to `kernel->width` and `args->psi` to be equal to `kernel->height`. This would lead to an out-of-bounds read when these values are used as coordinates. The patch corrects this by changing the comparison to `>=`, correctly validating the input and preventing the out-of-bounds read

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.