CVE-2024-41817 - CVE House

Back to Database

Status published High CVE-2024-41817

Arbitrary Code Execution in `AppImage` version `ImageMagick`

7 CVSS

Vulnerability Description

ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The `AppImage` version `ImageMagick` might use an empty path when setting `MAGICK_CONFIGURE_PATH` and `LD_LIBRARY_PATH` environment variables while executing, which might lead to arbitrary code execution by loading malicious configuration files or shared libraries in the current working directory while executing `ImageMagick`. The vulnerability is fixed in 7.11-36.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-41817

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from ImageMagick

View All →

ImageMagick converting a malicious MVG file to SVG caused an integer overflow.

Magick's failure to limit MVG mutual references forming a loop

Magick's failure to limit the depth of SVG file reads caused a DoS attack.

ImageMagick vulnerable to heap-buffer-overflow

ImageMagick is vulnerable to an Integer Overflow in TIM decoder leading to out of bounds read (32-bit only)

Affected Vendor

ImageMagick

View all reports →

Affected Software

ImageMagick

Vulnerable Versions:

< 7.11-36

Timeline

Official Publish: July 29th, 2024

Last Modified: August 2nd, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1574 Hijack Execution Flow

T1574.001 DLL Search Order Hijacking

Privilege Escalation

T1547 Boot or Logon Autostart Execution

T1036 Masquerading

Defense Evasion

T1059 Command and Scripting Interpreter