CVE-2024-41817

Deeper analysis

ImageMagick's AppImage packaging is affected by an untrusted search path vulnerability (CWE-427) in which the AppRun script sets the MAGICK_CONFIGURE_PATH and LD_LIBRARY_PATH environment variables to include an empty entry. This occurs because the script constructs the paths without properly handling the current working directory, allowing the ImageMagick 7.x AppImage (prior to version 7.11-36) to load configuration files or shared libraries from that location during execution.

An attacker with local access and the ability to write to a victim's current working directory can exploit the flaw by placing a malicious configuration file or library with a predictable name. When a user or process subsequently runs the AppImage, ImageMagick will load the attacker's code, resulting in arbitrary code execution with the privileges of the ImageMagick process. The CVSS 7.0 score reflects the local attack vector, high complexity, and low privileges required, with no user interaction needed.

The GitHub Security Advisory GHSA-8rxc-922v-phg8 and the referenced commit 6526a2b28510ead6a3e14de711bb991ad9abff38 document the root cause in the AppRun script and confirm the issue is resolved in ImageMagick 7.11-36 by ensuring the environment variables do not contain empty path components. The EPSS score has remained near 0.19 with only minor fluctuation since disclosure.