CVE-2023-3745

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of service.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Jul 24, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-374508.8The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5,CVE-2023-374534.6An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in read_descriptors in dCVE-2023-374545.5An issue was discovered in the Linux kernel through 6.4.2. A crafted UDF filesystem image causes a use-after-free write operation in the udfCVE-2023-374555.4The permission request prompt from the site in the background tab was overlaid on top of the site in the foreground tab. This vulnerability CVE-2023-374566.5The session restore helper crashed whenever there was no parameter sent to the message handler. This vulnerability affects Firefox for iOS <CVE-2023-374578.2Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk versions 18.20.0 and prior, 20.5.0 and prior, and 21.0CVE-2023-374595.3Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when a packet is received, the Contiki-NG netwoCVE-2023-37465.4The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and abCVE-2023-374609.8Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArchCVE-2023-374619.8Metersphere is an opensource testing framework. Files uploaded to Metersphere may define a `belongType` value with a relative path like `../CVE-2023-374628.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document `CVE-2023-374637.5cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Thr