ImageMagick is a software suite to create, edit, compose, or convert bitmap images. ImageMagick versions prior to 7.1.2-8 are vulnerable to denial-of-service due to unsigned integer underflow and division-by-zero in the CLAHEImage function. When tile width or height is zero, unsigned underflow occurs in pointer arithmetic, leading to out-of-bounds memory access, and division-by-zero causes immediate crashes. This issue has been patched in version 7.1.2-8.

Affected: NuGet: Magick.NET-Q16-x64, NuGet: Magick.NET-Q8-x64, NuGet: Magick.NET-Q16-HDRI-x64, NuGet: Magick.NET-Q8-OpenMP-x64, NuGet: Magick.NET-Q16-HDRI-OpenMP-x64, NuGet: Magick.NET-Q16-OpenMP-x64, NuGet: Magick.NET-Q8-arm64, NuGet: Magick.NET-Q16-arm64, NuGet: Magick.NET-Q16-OpenMP-arm64, NuGet: Magick.NET-Q8-OpenMP-arm64 and 2 more

## Summary

A single root cause in the CLAHE implementation — tile width/height becoming zero — produces two distinct but related unsafe behaviors. Vulnerabilities exists in the `CLAHEImage()` function of ImageMagick’s `MagickCore/enhance.c`.

1. Unsigned integer underflow → out-of-bounds pointer arithmetic (OOB): when `tile_info.height == 0`, the expression `tile_info.height - 1` (unsigned) wraps to a very large value; using that value in pointer arithmetic yields a huge offset and OOB memory access (leading to memory corruption, SIGSEGV, or resource exhaustion). 2. **Division/modulus by zero**: where code performs `... / tile_info.width` or `... % tile_info.height` without re-checking for zero, causing immediate division-by-zero crashes under sanitizers or `abort` at runtime.

Both behaviors are triggered by the same invalid tile condition (e.g., CLI exact `-clahe 0x0!` or automatic tile derivation `dim >> 3 == 0` for very small images).

---

## Details

### **Unsigned underflow(can lea to OOB)**

- Location: `MagickCore/enhance.c`, around line 609 - Version tested: 7.1.2-8 (local ASan(undefined). /UBSan build) - Vulnerable code enhance.c: 609 ```c p += (ptrdiff_t) clahe_info->width * (tile.height - 1); ``` - Root Cause - If `tile.height == 0`, then `(tile.height - 1)` underflows to `UINT_MAX`. - Multiplication with `clahe_info->width` yields a huge value close to `SIZE_MAX`. - Adding this to `p` causes pointer arithmetic underf…

Affected: openEuler:24.03-LTS-SP1: ImageMagick

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves. Security Fix(es):

ImageMagick is a software suite to create, edit, compose, or convert bitmap images. ImageMagick versions prior to 7.1.2-8 are vulnerable to denial-of-service due to unsigned integer underflow and division-by-zero in the CLAHEImage function. When tile width or height is zero, unsigned underflow occurs in pointer arithmetic, leading to out-of-bounds memory access, and division-by-zero causes immediate crashes. This issue has been patched in version 7.1.2-8.(CVE-2025-62594)

ImageMagick-7.1.2.8-1.1 on GA media

Security update for ImageMagick

Affected: Ubuntu:25.10: imagemagick, Ubuntu:26.04:LTS: imagemagick

ImageMagick is a software suite to create, edit, compose, or convert bitmap images. ImageMagick versions prior to 7.1.2-8 are vulnerable to denial-of-service due to unsigned integer underflow and division-by-zero in the CLAHEImage function. When tile width or height is zero, unsigned underflow occurs in pointer arithmetic, leading to out-of-bounds memory access, and division-by-zero causes immediate crashes. This issue has been patched in version 7.1.2-8.

Ein lokaler Angreifer kann eine Schwachstelle in ImageMagick ausnutzen, um einen Denial of Service Angriff durchzuführen.