CVE-2018-16328

Vulnerability

In ImageMagick versions before 7.0.8-8, the CheckEventLogging function in MagickCore/log.c contains a NULL pointer dereference. The function calls GetNextValueInLinkedList(log_cache) without validating the return value. When the linked list is exhausted (i.e., list_info->next == (ElementInfo *) NULL), the function returns NULL, and the subsequent dereference of p->event_mask at line 676 causes a crash [1].

Exploitation

An attacker can trigger this vulnerability by providing a crafted image file that causes ImageMagick to process logging events until the log cache linked list is fully traversed. No authentication or special privileges are required; the attacker only needs to submit a malicious file to an application using ImageMagick's conversion or processing capabilities [1].

Impact

Successful exploitation results in a denial-of-service (DoS) condition via a NULL pointer dereference, causing ImageMagick to crash. This can disrupt services that rely on ImageMagick for image processing. There is no evidence of code execution or information disclosure [1].

Mitigation

The vulnerability is fixed in ImageMagick version 7.0.8-8 [1]. Users should upgrade to this version or later. No workarounds are available for earlier versions.