DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-VF33-6R7X-66XX: GHSA-VF33-6R7X-66XX: Division by Zero and Integer Overflow in ImageMagick Morphology

#security #cve #cybersecurity #ghsa

GHSA-VF33-6R7X-66XX: Division by Zero and Integer Overflow in ImageMagick Morphology

Vulnerability ID: GHSA-VF33-6R7X-66XX
CVSS Score: 3.3
Published: 2026-05-21

ImageMagick versions prior to 7.1.1-33 contain an integer overflow vulnerability within the morphology module's binomial kernel generation logic. This integer overflow propagates to yield a division by zero error, resulting in a denial of service.

TL;DR

An unbounded integer overflow in ImageMagick's factorial calculation for binomial kernels leads to a mathematical division by zero. Attackers can trigger this denial of service by supplying an excessively large kernel radius.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-369, CWE-190
  • Attack Vector: Local / Context-Dependent API
  • Impact: Denial of Service (Application Crash)
  • Exploit Status: Proof-of-Concept
  • Severity: Low
  • CISA KEV: Not Listed

Affected Systems

  • ImageMagick
  • Magick.NET
  • ImageMagick: < 7.1.1-33 (Fixed in: 7.1.1-33)
  • Magick.NET: < 7.1.1-33 equivalent (Fixed in: 7.1.1-33 equivalent)

Code Analysis

Commit: d67eef7

Fix for integer overflow and division by zero in binomial kernel generation

Exploit Details

Mitigation Strategies

  • Update ImageMagick and associated wrapper libraries (Magick.NET) to version 7.1.1-33 or newer.
  • Implement strict input validation for user-supplied image processing parameters, explicitly limiting morphology kernel radius sizes.
  • Ensure web applications do not directly pass unvalidated user input into ImageMagick command-line arguments.

Remediation Steps:

  1. Identify all deployments of ImageMagick and Magick.NET within the environment.
  2. Upgrade all identified packages to at least version 7.1.1-33.
  3. Audit applications interacting with the ImageMagick API to confirm that morphology operations (specifically Binomial) utilize sanitized parameters.
  4. Restart dependent application pools and services to ensure the patched shared libraries are loaded.

References

Read the full report for GHSA-VF33-6R7X-66XX on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)