CVE-2018-16641

Vulnerability

In ImageMagick 7.0.8-6, the TIFFWritePhotoshopLayers function in coders/tiff.c has a memory leak vulnerability [1]. When memory allocation fails for clone_info, layers, custom_stream, or blob, the function calls ThrowBinaryException without first destroying the base_image object that was cloned at the start of the function (line 3122). This results in leaked memory because the exception path does not free base_image before returning [1]. The issue affects version 7.0.8-6 and possibly earlier versions [1].

Exploitation

An attacker can trigger this memory leak by providing a crafted TIFF image file to ImageMagick that causes memory allocation failures during the TIFF writing process, such as when converting or processing the file [1]. No special privileges are required beyond the ability to supply a malicious image to an application using ImageMagick. The leak occurs via the normal image processing flow without requiring any race condition [1].

Impact

Successful exploitation leads to a memory leak, which can degrade system performance over time and may lead to denial-of-service if sufficient memory is exhausted [1]. The impact is limited to memory consumption, with no disclosure, modification, or escalation of privileges [1].

Mitigation

The vulnerability is fixed in ImageMagick commit 256825d4eb33dc301496710d15cf5a7ae924088b, which adds calls to DestroyImage(base_image) before each ThrowBinaryException in the affected allocation failure paths [2]. Users should upgrade to a version containing this fix or apply the patch. No workaround is available if the fix cannot be applied [1].