What’s Vulnerable › Vulnerabilities

CVE-2021-20224

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-08-25 · updated 2026-06-17
• Weakness: CWE-190

Description

An integer overflow issue was discovered in ImageMagick's ExportIndexQuantum() function in MagickCore/quantum-export.c. Function calls to GetPixelIndex() could result in values outside the range of representable for the 'unsigned char'. When ImageMagick processes a crafted pdf file, this could lead to an undefined behaviour or a crash.

Affected products

• ImageMagick: before 6.9.11-57; from 7.0.0-0 before 7.0.10-57 — fixed in 6.9.11-57, 7.0.10-57

How to fix

Upgrade to a fixed version: ImageMagick 6.9.11-57, 7.0.10-57. Check the vendor advisory for mitigations.

References

• https://github.com/ImageMagick/ImageMagick/commit/5af1dffa4b6ab984b5f13d1e91c95760d75f12a6
• https://github.com/ImageMagick/ImageMagick/pull/3083
• https://github.com/ImageMagick/ImageMagick6/commit/553054c1cb1e4e05ec86237afef76a32cd7c464d
• https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html
• https://github.com/ImageMagick/ImageMagick/commit/5af1dffa4b6ab984b5f13d1e91c95760d75f12a6
• https://github.com/ImageMagick/ImageMagick/pull/3083
• https://github.com/ImageMagick/ImageMagick6/commit/553054c1cb1e4e05ec86237afef76a32cd7c464d
• https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html

Get alerted when CVE-2021-20224 or the next vulnerability affects your stack