JLSEC-2026-925 ImageMagick (WriteBMPImage): 32-bit integer overflow when writing BMP scanline stride → heap buffer overflow

Summary A 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytesperline stride to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the overflowed stride, so the first row immediately writes...

GHSA-MXVV-97WH-CFMM ImageMagick (WriteBMPImage): 32-bit integer overflow when writing BMP scanline stride → heap buffer overflow

Summary A 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytesperline stride to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the overflowed stride, so the first row immediately writes...

graphicsmagick:coder_BMP_fuzzer: Use-of-uninitialized-value in WriteBMPImage

Detailed Report: https://oss-fuzz.com/testcase?key=4519503696101376 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderBMPfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: WriteBMPImage WriteImage...