CVE-2018-11655

Vulnerability

A memory leak vulnerability exists in ImageMagick version 7.0.7-20 Q16 x86_64. The flaw resides in the GetImagePixelCache function within MagickCore/cache.c. When processing a specially crafted CALS image file, the function fails to properly free allocated pixel cache memory, leading to progressive memory consumption. The issue is triggered via WriteCALSImage in coders/cals.c during image format conversion operations [1].

Exploitation

An attacker must deliver a malicious CALS image file to the victim and convince them to process it using ImageMagick (e.g., via convert or magick commands). No special privileges or network position are required beyond the ability to supply the file. The vulnerability manifests when ImageMagick converts the CALS image to a different format, such as GROUP4 TIFF, as demonstrated by the trigger command WriteGROUP4Image-memory-leaks /dev/null. The memory leak occurs repeatedly for each crafted file processed [1].

Impact

Successful exploitation results in a denial of service (DoS) condition. The attacker can exhaust available system memory by repeatedly triggering the leak, potentially causing the application to crash or the system to become unresponsive. The vulnerability only affects availability; there is no evidence of information disclosure or code execution from the available references [1].

Mitigation

The ImageMagick project has not released a specific patch for this issue in the available references. Users should upgrade to a version newer than 7.0.7-20 if a fix becomes available. As a workaround, avoid processing untrusted CALS image files or use a policy to restrict the CALS decoder. At the time of publication, no vendor advisory or KEV listing exists [1].