VYPR
← All advisories
High severity8.8NVD Advisory· Published Aug 23, 2017· Updated May 13, 2026

CVE-2017-13146

CVE-2017-13146

Description

Memory leak in ImageMagick's ReadMATImage function allows denial of service via crafted MAT file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Memory leak in ImageMagick's ReadMATImage function allows denial of service via crafted MAT file.

Vulnerability

A memory leak exists in ImageMagick before version 6.9.8-5 and version 7.x before 7.0.5-6 in the ReadMATImage function within coders/mat.c. The leak occurs because the QuantumInfo structure is not properly initialized to NULL before use, and DestroyQuantumInfo is called without first checking if the pointer is non-null. This affects the parsing of MATLAB MAT image files. Versions prior to the fix are vulnerable when processing specially crafted .mat files [1].

Exploitation

An attacker can trigger this vulnerability by supplying a maliciously crafted MATLAB .mat file to an application using ImageMagick for image processing. No special privileges are required; the user or service processing the file must open it with ImageMagick. The exploit does not require authentication or network access beyond delivering the file. The sequence involves the ReadMATImage code path, where a failure to initialize quantum_info leads to calling DestroyQuantumInfo on an uninitialized pointer, causing a memory leak [1].

Impact

Successful exploitation results in a memory leak, which can exhaust system memory over repeated operations, leading to a denial of service (DoS) condition. The vulnerability does not directly allow code execution or data theft, but the memory exhaustion can cause instability or crash the application, affecting availability [2].

Mitigation

ImageMagick version 6.9.8-5 and version 7.0.5-6 contain the fix. Users should upgrade to these or later versions. For details, see the commit [1] and Gentoo advisory GLSA 201711-07 [2]. No workaround is available; updating is the recommended mitigation.

References
  1. ... · ImageMagick/ImageMagick@79e5dbc
  2. Multiple vulnerabilities (GLSA 201711-07) — Gentoo security

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

64

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

3

News mentions

0

No linked articles in our index yet.