CVE-2020-27752

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-12-08 · updated 2026-06-17
Weakness: CWE-122

Description

A flaw was found in ImageMagick in MagickCore/quantum-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger a heap buffer overflow. This would most likely lead to an impact to application availability, but could potentially lead to an impact to data integrity as well. This flaw affects ImageMagick versions prior to 7.0.9-0.

Affected products

ImageMagick: before 6.9.11-47; from 7.0.0-0 before 7.0.9-0 — fixed in 6.9.11-47, 7.0.9-0

How to fix

Upgrade to a fixed version: ImageMagick 6.9.11-47, 7.0.9-0. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1894226
https://bugzilla.redhat.com/show_bug.cgi?id=1894226

Get alerted when CVE-2020-27752 or the next vulnerability affects your stack