CVE-2018-10804

Vulnerability

ImageMagick version 7.0.7-28 contains a memory leak in the WriteTIFFImage function in coders/tiff.c. When processing a TIFF image, the function allocates a QuantumInfo structure via AcquireQuantumInfo [1]. If the image meets certain conditions (storage class not PseudoClass, depth ≥ 32, undefined quantum format, and high dynamic range), it attempts to set the quantum format to floating point. If SetQuantumFormat fails (e.g., due to resource limits), the function returns without freeing the previously allocated quantum_info, causing a memory leak [1].

Exploitation

An attacker can exploit this vulnerability by providing a crafted TIFF image that satisfies the required conditions: storage_class != PseudoClass, depth >= 32, quantum_info->format == UndefinedQuantumFormat, and IsHighDynamicRangeImage returning true. The attacker does not need authentication or special privileges; they only need to submit the image to an application using ImageMagick to process it. Repeated processing of such images can exhaust available memory, leading to denial of service.

Impact

Successful exploitation results in a memory leak, which can lead to memory exhaustion and denial of service. The attacker gains no code execution or data access; the impact is limited to availability.

Mitigation

The issue was reported in the ImageMagick issue tracker [1]. The available reference does not specify a fixed version; users should upgrade to the latest version of ImageMagick (7.0.7-29 or later) if a patch has been released, or apply any vendor-supplied update. As a workaround, avoid processing untrusted TIFF images with ImageMagick until a fix is applied.