CVE-2024-41817: imagemagick Uncontrolled Search Path Element

Vulnerability summary

CVE-2024-41817 is a high (CVSS 7.8) Uncontrolled Search Path Element vulnerability in imagemagick. EPSS estimates a 0.93% chance of exploitation in the next 30 days, higher than 60.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 29-07-2024
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The `AppImage` version `ImageMagick` might use an empty path when setting `MAGICK_CONFIGURE_PATH` and `LD_LIBRARY_PATH` environment variables while executing, which might lead to arbitrary code execution by loading malicious configuration files or shared libraries in the current working directory while executing `ImageMagick`. The vulnerability is fixed in 7.11-36.

• CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.