Vulnerability · Published Jun 16, 2022 · Assigned by redhat

CVE-2022-32546

High 7.8

In plain English

A high-severity integer overflow in ImageMagick. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High

Exploit odds (30 days)1.4%top 27.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.20	imagemagick	7.0.10.31-r0	ALPINE-CVE-2022-32546
Alpine:v3.21	imagemagick	7.0.10.31-r0	ALPINE-CVE-2022-32546
Alpine:v3.22	imagemagick	7.0.10.31-r0	ALPINE-CVE-2022-32546
Alpine:v3.23	imagemagick	7.0.10.31-r0	ALPINE-CVE-2022-32546
Alpine:v3.24	imagemagick	7.0.10.31-r0	ALPINE-CVE-2022-32546
Debian:12	imagemagick	8:6.9.11.60+dfsg-1.5	DEBIAN-CVE-2022-32546
Debian:13	imagemagick	8:6.9.11.60+dfsg-1.5	DEBIAN-CVE-2022-32546
Debian:14	imagemagick	8:6.9.11.60+dfsg-1.5	DEBIAN-CVE-2022-32546

Affected products (as reported)

Vendor	Product	Versions
n/a	ImageMagick	Fixed in ImageMagick 6.9.12-44, ImageMagick 7.1.0-29

Weakness: CWE-190

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References