CVE-2018-10805

Vulnerability

ImageMagick version 7.0.7-28 contains a memory leak in the ReadYCBCRImage function in coders/ycbcr.c. When processing a YCbCr image, the function allocates a canvas_image via CloneImage and then attempts to acquire quantum information via AcquireQuantumInfo. If AcquireQuantumInfo fails (returns NULL), the function throws an exception but does not free the previously allocated canvas_image, resulting in a memory leak [1].

Exploitation

An attacker can trigger this memory leak by providing a crafted YCbCr image that causes AcquireQuantumInfo to fail. No special privileges are required; the attacker only needs to submit the malicious image to an application using the vulnerable ImageMagick library. The leak occurs during the decoding process, and repeated processing of such images can lead to memory exhaustion.

Impact

Successful exploitation leads to a memory leak, which can cause memory exhaustion and denial of service (DoS) for the application processing the image. The vulnerability does not allow code execution or information disclosure; it is a resource exhaustion issue.

Mitigation

The issue was reported in the ImageMagick issue tracker [1], but no specific fixed version is mentioned in the reference. Users should upgrade to a version of ImageMagick newer than 7.0.7-28 that includes a fix for this memory leak. If an upgrade is not immediately possible, avoid processing untrusted YCbCr images as a workaround.