CVE-2022-44267
Published: 06 February 2023
Summary
CVE-2022-44267 is a medium-severity Improper Resource Shutdown or Release (CWE-404) vulnerability in Imagemagick Imagemagick. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 4.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
ImageMagick version 7.1.0-49 contains a denial-of-service vulnerability when parsing PNG images, such as during resize operations. The convert process can enter an indefinite wait for stdin input, leaving the affected component unable to complete or terminate normally. The flaw is tracked as CWE-404 and carries a CVSS 3.1 score of 6.5 reflecting network attack vector, low complexity, and high availability impact.
An unauthenticated remote attacker can supply a crafted PNG file that a victim processes with ImageMagick; user interaction is required to trigger the conversion. Successful exploitation causes the convert process to hang, producing a denial of service without disclosing data or altering system state.
Advisories from Debian, Fedora, and the ImageMagick project indicate that updated packages addressing the issue are available through standard distribution channels, including backports for older releases.
EPSS scores for the CVE rose from a low baseline to a peak of 0.2209 before settling at the current value of 0.1769, indicating measurable post-disclosure exploitation interest that warrants renewed attention from practitioners.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-47215
Vulnerability details
ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin input.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Contingency plan updates incorporate proper resource shutdown and release steps, preventing attackers from leveraging incomplete cleanup during recovery scenarios.
Mandates explicit shutdown of the network connection at session conclusion, directly addressing improper resource release.
Requires proper shutdown/release procedures that include overwriting or isolating data to block unintended transfer via reused system objects.
Procedures can mandate orderly shutdown or release of resources when failures occur, preventing improper resource handling after a fault.