{"id":"CVE-2020-27752","url":"https://www.cyber-defence.io/tools/cve/CVE-2020-27752","generatedAt":"2026-10-28T05:26:20.149Z","title":"An attacker who submits a crafted file that is processed by ImageMagick could trigger a heap buffer overflow.","description":"A flaw was found in ImageMagick in MagickCore/quantum-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger a heap buffer overflow. This would most likely lead to an impact to application availability, but could potentially lead to an impact to data integrity as well. This flaw affects ImageMagick versions prior to 7.0.9-0.","published":"2020-12-08T22:15:18.000Z","lastModified":"2026-06-17T03:09:35.000Z","status":"Modified","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":7.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H"},"cwe":["CWE-122"],"affected":["imagemagick/imagemagick"],"epss":{"score":0.01086,"percentile":0.65109,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (1.09%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1894226","tags":["Exploit","Issue Tracking","Patch","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1894226","tags":["Exploit","Issue Tracking","Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-27752","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}