CVE-2020-25676: 
ImageMagick vulnerability analysis and mitigation

In ImageMagick versions prior to 7.0.9-0, multiple unconstrained pixel offset calculations in MagickCore/pixel.c functions (CatromWeights, MeshInterpolate, InterpolatePixelChannel, InterpolatePixelChannels, and InterpolatePixelInfo) produced undefined behavior in the form of out-of-range and integer overflows, as identified by UndefinedBehaviorSanitizer (Red Hat Bug).

The vulnerability stems from unconstrained pixel offset calculations being used with the floor() function in multiple functions within the MagickCore/pixel.c file. These calculations could result in undefined behavior through out-of-range values and integer overflows. The issue has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

The vulnerability could be triggered by an attacker who supplies a crafted input file to be processed by ImageMagick. These issues could impact application availability through denial of service or potentially cause other problems related to undefined behavior (Red Hat Bug).

The vulnerability requires an attacker to supply a specially crafted input file that would be processed by ImageMagick. The attack requires local access and user interaction to process the malicious file (NVD).

The vulnerability has been fixed in ImageMagick version 7.0.9-0. Users are recommended to upgrade to this version or later. Multiple Linux distributions have also released security updates to address this vulnerability, including Ubuntu and Debian (Ubuntu Notice, Debian LTS).