Heap overwrite via truncated XBM row count

Heap buffer overflow in ImageMagick allows remote attackers to overwrite heap memory with controlled bytes via a crafted XBM image. ReadXBMImage truncates the size_t row count to unsigned int when allocating its XBM data buffer, then iterates using the original row count and copies attacker-controlled hex bytes past the allocation. No product authentication or user interaction is required when an application automatically processes untrusted uploads; exploitation requires extreme XBM dimensions that trigger truncation.