Vulnerability · Published Feb 24, 2022 · Assigned by redhat
CVE-2021-3610
High 7.5
In plain English
A high-severity out-of-bounds read in ImageMagick. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.8%top 13.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A heap-based buffer overflow vulnerability was found in ImageMagick in versions prior to 7.0.11-14 in ReadTIFFImage() in coders/tiff.c. This issue is due to an incorrect setting of the pixel array size, which can lead to a crash and segmentation fault.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | imagemagick | 8:6.9.11.60+dfsg-1.6+deb12u1 | DEBIAN-CVE-2021-3610 |
| Debian:12 | imagemagick | 8:6.9.11.60+dfsg-1.6+deb12u1 | DSA-5628-1 |
| Debian:13 | imagemagick | 8:6.9.12.98+dfsg1-2 | DEBIAN-CVE-2021-3610 |
| Debian:14 | imagemagick | 8:6.9.12.98+dfsg1-2 | DEBIAN-CVE-2021-3610 |
| Ubuntu:24.04:LTS | imagemagick | 8:6.9.11.60+dfsg-1.6ubuntu1 | UBUNTU-CVE-2021-3610 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | ImageMagick | ImageMagick 7.0.11-14 |
Weakness: CWE-125
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1973689
- https://github.com/ImageMagick/ImageMagick/commit/930ff0d1a9bc42925a7856e9ea53f5fc9f318bf3
- [oss-security] 20230529 Update CVE-2021-3610: ImageMagick mailing-list
- [oss-security] 20230605 RE: Update CVE-2021-3610 mailing-list
- https://github.com/fuzzing2026/CVE-PoCs/tree/main/imagemagick-CVE-2021-3610