What’s Vulnerable › Vulnerabilities

CVE-2022-32547

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-06-16 · updated 2026-06-17
• Weakness: CWE-704

Description

In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and for type 'float', which requires 4 byte alignment at MagickCore/property.c. Whenever crafted or untrusted input is processed by ImageMagick, this causes a negative impact to application availability or other problems related to undefined behavior.

Affected products

• Fedoraproject Fedora: 36
• ImageMagick: before 6.9.12-45; from 7.1.0-0 before 7.1.0-30 — fixed in 6.9.12-45, 7.1.0-30
• Red Hat Enterprise Linux: 6.0, 7.0

How to fix

Upgrade to a fixed version: ImageMagick 6.9.12-45, 7.1.0-30. Check the vendor advisory for mitigations.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=2091813
• https://github.com/ImageMagick/ImageMagick/commit/eac8ce4d873f28bb6a46aa3a662fb196b49b95d0
• https://github.com/ImageMagick/ImageMagick6/commit/dc070da861a015d3c97488fdcca6063b44d47a7b
• https://lists.debian.org/debian-lts-announce/2023/05/msg00020.html
• https://bugzilla.redhat.com/show_bug.cgi?id=2091813
• https://github.com/ImageMagick/ImageMagick/commit/eac8ce4d873f28bb6a46aa3a662fb196b49b95d0
• https://github.com/ImageMagick/ImageMagick6/commit/dc070da861a015d3c97488fdcca6063b44d47a7b
• https://lists.debian.org/debian-lts-announce/2023/05/msg00020.html

Get alerted when CVE-2022-32547 or the next vulnerability affects your stack