CVE-2021-40211
📋 TL;DR
This vulnerability in ImageMagick allows attackers to cause a denial of service (DoS) or potentially execute arbitrary code via a division by zero error when processing Enhanced Metafile (EMF) images. It affects systems running vulnerable versions of ImageMagick that process untrusted EMF files. The vulnerability is triggered during EMF file parsing in the ReadEnhMetaFile function.
💻 Affected Systems
- ImageMagick
📦 What is this software?
Imagemagick by Imagemagick
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if the division by zero can be leveraged for memory corruption.
Likely Case
Denial of service causing ImageMagick to crash when processing malicious EMF files.
If Mitigated
Limited impact with proper input validation and sandboxing preventing file processing from untrusted sources.
🎯 Exploit Status
Proof of concept available in GitHub issues. Exploitation requires only a malicious EMF file to be processed by ImageMagick.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in ImageMagick 7.1.0-5 and later
Vendor Advisory: https://github.com/ImageMagick/ImageMagick/issues/4097
Restart Required: No
Instructions:
1. Update ImageMagick to version 7.1.0-5 or later. 2. For Linux: Use package manager (apt-get upgrade imagemagick, yum update imagemagick). 3. For Windows: Download updated binaries from ImageMagick website. 4. For source builds: Pull latest code from GitHub repository.
🔧 Temporary Workarounds
Disable EMF coder
allRemove or disable the EMF file format support in ImageMagick configuration
Edit policy.xml: <policy domain="coder" rights="none" pattern="EMF" />
Input validation
allReject EMF files at application level before passing to ImageMagick
🧯 If You Can't Patch
- Implement strict file type validation to block EMF files from untrusted sources
- Run ImageMagick in sandboxed/containerized environment with limited privileges
🔍 How to Verify
Check if Vulnerable:
Check ImageMagick version: convert --version | grep Version. If version is 7.1.0-4 or earlier, system is vulnerable.Check Version:
convert --version | grep VersionVerify Fix Applied:
After update, verify version is 7.1.0-5 or later using convert --version📡 Detection & Monitoring
Log Indicators:
- ImageMagick segmentation faults or crashes when processing EMF files
- Error messages mentioning 'division by zero' or 'ReadEnhMetaFile'
Network Indicators:
- Unusual uploads of EMF files to web applications
SIEM Query:
process_name="convert" AND (event_type="crash" OR error_message="*division by zero*")