What is CVE-2022-44268?

CVE-2022-44268 is a medium-severity vulnerability in ImageMagick 7.1.0-49. It can lead to information disclosure when parsing a PNG image, potentially exposing the content of arbitrary files if the ImageMagick binary has read permissions.

Who is impacted by CVE-2022-44268?

CVE-2022-44268 affects users of ImageMagick versions 6.9.11-60, 7.1.0-48, and 7.1.0-49. Users of Fedora 36 with ImageMagick installed and versions prior to 6.9.12.77 are also at risk.

What to do if CVE-2022-44268 affected you

If you're affected by the CVE-2022-44268 vulnerability, it's crucial to take action to protect your system. Follow these simple steps to mitigate the risk:

1. Update ImageMagick to the latest version, as mentioned in the Fedora Mailing-Lists announcement.

2. Implement a security policy for ImageMagick, as advised on the ImageMagick website.

3. Verify your security policy using the ImageMagick Security Evaluator.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

CVE-2022-44268, also known as ImageMagick 7.1.0-49 Information Disclosure, is not listed in CISA's Known Exploited Vulnerabilities Catalog. The vulnerability was published on February 6, 2023.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as Insufficient Information, indicating a lack of specific details about the vulnerability and its mitigation.

Learn More

For comprehensive information on this vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or refer to the sources below.

• ImageMagick 7.1.0-48 Arbitrary File Read ≈ Packet Storm

• ImageMagick – Mastering Digital Image Alchemy

• [SECURITY] Fedora 36 Update: ImageMagick-6.9.12.77-1.fc36 - package-announce - Fedora Mailing-Lists