cve/2023/CVE-2023-1906.md

### [CVE-2023-1906](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1906)
![](https://img.shields.io/static/v1?label=Product&message=ImageMagick&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-122%20-%20Heap-based%20Buffer%20Overflow%2C%20CWE-125%20-%20Out-of-bounds%20Read.&color=brighgreen)

### Description

A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service.

### POC

#### Reference
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-35q2-86c7-9247
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-35q2-86c7-9247

#### Github
No PoCs found on GitHub currently.