CVE-2022-24130

What it actually does

Buffer overflow in set_sixel function within graphics_sixel.c triggered by crafted Sixel text when support is enabled, leading to memory corruption and potential denial of service or code execution.

Why it matters to the business

Attackers can crash image processing or terminal applications on affected systems, causing service disruption; the issue has been publicly exploitable for over 4 years with low but stable EPSS and no ransomware use, so patching reduces moderate operational risk across ImageMagick-dependent environments.

How an attack unfolds

An attacker supplies crafted Sixel graphics sequences in text input or files; when the vulnerable set_sixel handler processes them, the overflow occurs, enabling crash or arbitrary code execution on local systems.

How to fix it

Upgrade ImageMagick to commit 9c9a84cec4ab28ee0b57c2b9266d6fbe68183512 or ImageMagick6 to commit 450949ed017f009b399c937cf362f0058eacc5fa; disable Sixel support where feasible until patched.

How to confirm the fix worked

Confirm the exact commit hashes are present in the built source or binaries; test with known Sixel trigger inputs to ensure no crash occurs.

Typical attack path

1. Identify target running vulnerable ImageMagick or xterm with Sixel enabled
2. Craft malicious Sixel data to trigger set_sixel overflow
3. Deliver via local file, piped input, or document
4. Trigger processing to achieve denial of service or code execution

How to detect it

Review process crash logs and application error reports for set_sixel or graphics_sixel failures; inspect input files or terminal sessions containing Sixel sequences for anomalies.

What your security team should do

• Apply the listed GIT commits to all affected ImageMagick installations immediately
• Audit and disable Sixel graphics support in configurations where not required
• Monitor application stability logs for related crashes pending full rollout