CVE-2017-18250

Vulnerability

In ImageMagick 7.0.7, the function LogOpenCLBuildFailure in MagickCore/opencl.c contains a NULL pointer dereference vulnerability. The function calls AcquireMagickMemory(log_size) at line 1307, which can return NULL, leading to a subsequent dereference of the log pointer. This issue is triggered when processing a crafted file that invokes OpenCL program building [1].

Exploitation

An attacker can exploit this vulnerability by supplying a specially crafted file that causes AcquireMagickMemory to fail and return NULL. No special privileges or user interaction beyond opening the file is required. The crafted file triggers the code path in LogOpenCLBuildFailure, causing a null pointer dereference [1].

Impact

Successful exploitation results in a denial of service due to a program crash. No other impact (confidentiality, integrity) is demonstrated [1].

Mitigation

No official fix has been disclosed in the available references. Users are advised to monitor the ImageMagick project for updates or apply patches if available. The issue was reported on the ImageMagick issue tracker [1].