CVE-2023-3745
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. A local attacker may trick the user into opening a specially crafted file, leading to an out-of-bounds read error and potentially causing the application to crash.
Risk Assessment
This issue may lead to a denial of service, affecting application availability and disrupting user operations.
Recommendation
It is recommended to update ImageMagick to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.
Original NVD description (English source)
A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of service.