CVE-2020-27755: imagemagick
Vulnerability summary
CVE-2020-27755 is a medium (CVSS 4.3) vulnerability in imagemagick. EPSS estimates a 0.86% chance of exploitation in the next 30 days, higher than 57.8% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 9 · Related 9Timeline
- 08-12-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
in SetImageExtent() of /MagickCore/image.c, an incorrect image depth size can cause a memory leak because the code which checks for the proper image depth size does not reset the size in the event there is an invalid size. The patch resets the depth to a proper size before throwing an exception. The memory leak can be triggered by a crafted input file that is processed by ImageMagick and could cause an impact to application reliability, such as denial of service. This flaw affects ImageMagick versions prior to 7.0.9-0.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · DebianEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
- NVDNIST3.3LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.86%
Chance of exploitation in the next 30 days
Percentile
58%
Versus all other CVEs
30-day change
0.00 pp
From 0.86% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (bugzilla.redhat.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- imagemagick< 8:6.9.11.24+dfsg-1
Imagemagick1 product
- imagemagick< 6.9.10-69 | ≥ 7.0.0-0, < 7.0.9-0
Ubuntu1 product
- imagemagick< 8:6.8.9.9-7ubuntu5.16+esm11 | < 8:6.9.7.4+dfsg-16ubuntu6.11 | < 8:6.9.10.23+dfsg-2.1ubuntu11.4
3 vendors · 3 products
References
6 links- bugzilla.redhat.com/show_bug.cgi?id=1894232X Refsource MISCExploitIssue TrackingPatchThird Party Advisory
