CVE-2022-27938

What it actually does

A reachable assertion failure in stbi__create_png_image_raw within stb_image.h causes abnormal termination when parsing a malformed PNG image.

Why it matters to the business

Applications handling images may crash on crafted PNG files, disrupting workflows and enabling local denial of service. The issue has been public for over four years with available exploits.

How an attack unfolds

An attacker creates a PNG image that violates internal assumptions in the PNG decoder. The victim opens or processes the file locally in an affected application such as ImageMagick, triggering the assertion and crashing the process.

How to fix it

Upgrade ImageMagick to the commit e50f19fd73c792ebe912df8ab83aa51a243a3da7 or newer that resolves the assertion in the PNG decoder.

How to confirm the fix worked

Confirm the installed ImageMagick binary or library was built after the referenced commit; attempt to load a known triggering PNG without causing a crash.

Typical attack path

1. Generate a PNG file that reaches the failing assertion in stbi__create_png_image_raw
2. Deliver the file to the target via local filesystem, email, or web download
3. Victim opens or converts the image using the vulnerable library
4. Application terminates due to the triggered assertion

How to detect it

Review application crash logs and core dumps for assertion failures or abnormal exits while processing PNG images; correlate with file access timestamps on suspicious PNG files.

• stbi__create_png_image_raw
• assertion failed
• stb_image.h

What your security team should do

• Update ImageMagick installations to the fixed commit immediately
• Block untrusted image files from automated processing pipelines until patched
• Review and remove any outdated copies of stb_image.h or libsixel from build environments