CVE-2020-27770

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.0.8-68

Description The issue is related to a missing check for a 0 value of replace extent in the SubstituteString() function, which can cause an offset p to overflow. This could be triggered by a crafted input file processed by ImageMagick, potentially impacting application availability. The flaw can be exploited by a remote attacker using a specially crafted file.

Recommendations For ImageMagick versions prior to 7.0.8-68, update to version 7.0.8-68 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted input files that could trigger the overflow in the SubstituteString() function.