CVE-2023-34475
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A heap use after free issue was discovered in ImageMagick's ReplaceXmpValue() function. An attacker could trick a user into opening a specially crafted file, triggering a heap-use-after-free write error, causing an application crash and resulting in a denial of service.
Risk Assessment
The organization may experience application downtime, leading to loss of service availability. Exploitation of this vulnerability could be used to conduct denial of service attacks.
Recommendation
It is recommended to update ImageMagick to the latest version to mitigate this vulnerability. Additionally, monitor and restrict opening files from untrusted sources.
Original NVD description (English source)
A heap use after free issue was discovered in ImageMagick's ReplaceXmpValue() function in MagickCore/profile.c. An attacker could trick user to open a specially crafted file to convert, triggering an heap-use-after-free write error, allowing an application to crash, resulting in a denial of service.