CVE-2020-10251

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In ImageMagick 7.0.9, an out-of-bounds read vulnerability exists within the ReadHEICImageByID function in coders\heic.c. It can be triggered via an image with a width or height value that exceeds the actual size of the image.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/ImageMagick/ImageMagick/issues/1859Exploit, Patch, Third Party Advisory
https://github.com/ImageMagick/ImageMagick/issues/1859Exploit, Patch, Third Party Advisory

Timeline

Published: Mar 10, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-102528.3An issue was discovered in ownCloud before 10.4. Because of an SSRF issue (via the apps/files_sharing/external remote parameter), an authent CVE-2020-102545.9An issue was discovered in ownCloud before 10.4. An attacker can bypass authentication on a password-protected image by displaying its previ CVE-2020-102559.0Modern DRAM chips (DDR4 and LPDDR4 after 2015) are affected by a vulnerability in deployment of internal mitigations against RowHammer attac CVE-2020-102569.8An issue was discovered in beta versions of the 1Password command-line tool prior to 0.5.5 and in beta versions of the 1Password SCIM bridge CVE-2020-102579.8The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allow CVE-2020-10269.8A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the libraryâ€™s CVE-2020-102626.8An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.58.10. Attackers can activate the failsafe mode during the boot process, and use CVE-2020-102636.8An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.52.4. Attackers can get root shell by accessing the UART interface and then they CVE-2020-102648.8CB3 SW Version 3.3 and upwards, e-series SW Version 5.0 and upwards allow authenticated access to the RTDE (Real-Time Data Exchange) interfa CVE-2020-102659.4Universal Robots Robot Controllers Version CB2 SW Version 1.4 upwards, CB3 SW Version 3.0 and upwards, e-series SW Version 5.0 and upwards e CVE-2020-102668.1UR+ (Universal Robots+) is a platform of hardware and software component sellers, for Universal Robots robots. When installing any of these CVE-2020-102677.5Universal Robots control box CB 3.1 across firmware versions (tested on 1.12.1, 1.12, 1.11 and 1.10) does not encrypt or protect in any way