Threats tagged 'ghsa-mxvv-97wh-cfmm'

A 32-bit integer overflow vulnerability exists in the BMP encoder of Magick.NET Q16 AnyCPU (ImageMagick) when writing BMP scanline stride. This overflow causes the computed stride (bytes_per_line) to become much smaller than the actual row size for 24-bpp images, leading to an attacker-controlled heap out-of-bounds write during BMP image conversion. The issue affects 32-bit builds and can cause heap corruption, potentially leading to denial of service or remote code execution. The vulnerability is fixed in version 14.8.1.