CVE-2020-27762: 
ImageMagick vulnerability analysis and mitigation

A vulnerability (CVE-2020-27762) was discovered in ImageMagick's coders/hdr.c component. The flaw affects ImageMagick versions prior to 7.0.8-68, where an attacker could trigger undefined behavior by submitting a crafted file that would result in values outside the range of type 'unsigned char' (NVD, Ubuntu Security).

The vulnerability has a CVSS v3.1 Base Score of 5.5 (Medium) with the following vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The flaw specifically occurs in the WriteHDRImage() function in coders/hdr.c where the code could attempt to set unsigned chars to values outside of their valid range, depending on pixel color values (Red Hat Bugzilla).

The primary impact of this vulnerability is to application availability, potentially leading to a denial of service condition. While there could be other unspecified impacts related to undefined behavior, no specific additional impacts were demonstrated (Red Hat Bugzilla, NVD).

The vulnerability requires local access and user interaction to exploit. An attacker would need to submit a specially crafted file that would be processed by ImageMagick to trigger the undefined behavior (Ubuntu Security).

The vulnerability was fixed in ImageMagick version 7.0.8-68. The patch adds checks for values greater than 0 to ensure that unsigned char values remain within their valid range. Various Linux distributions have also released security updates to address this vulnerability (Red Hat Bugzilla, Debian LTS).