CVE-2018-5246

Vulnerability

In ImageMagick 7.0.7-17 Q16, a memory leak exists in the ReadPATTERNImage function within coders/pattern.c. The issue is triggered when processing a malformed or unrecognized pattern file (e.g., poc.pattern). The CloneImageInfo call at line 966 in pattern.c allocates memory that is not properly freed upon error, resulting in a memory leak. Affected versions include ImageMagick 7.0.7-17 Q16 and possibly earlier versions [1].

Exploitation

An attacker can exploit this vulnerability by providing a crafted pattern file to the magick montage command (or any command that triggers ReadPATTERNImage). No authentication or special network position is required; the attacker only needs to convince a user to process the malicious file. The leak is demonstrated when ImageMagick attempts to read the file and fails due to unrecognized format, as shown in the reference [1] stack trace.

Impact

Successful exploitation leads to memory exhaustion over time, potentially causing a denial of service condition. The leak is detected by LeakSanitizer as direct and indirect memory leaks totaling over 13KB per operation. Repeated processing of such files could exhaust available memory, impacting system stability [1].

Mitigation

The official fix was released in ImageMagick version 7.0.7-19 on 2018-01-13. Users should upgrade to this version or later. No workarounds are documented; processing untrusted image files should be avoided until patching [1].