CVE-2018-5685

Vulnerability

In GraphicsMagick version 1.3.27, the ReadBMPImage function in coders/bmp.c contains an infinite loop vulnerability. When processing a BMP file with a crafted bit-field mask, specifically a green_mask value of 0xFFFFFFFF, the while loop at line 1110 (while (((bmp_info.green_mask << sample) & 0x80000000U) != 0)) never terminates because the condition remains true, causing sample to increment indefinitely and the application to hang [1].

Exploitation

An attacker can trigger this vulnerability by providing a specially crafted BMP image file with a green_mask set to 0xFFFFFFFF. No authentication or special privileges are required. The attacker simply needs to convince a user or system to process the malicious image (e.g., via gm convert). The provided proof-of-concept file causes GraphicsMagick to enter an infinite loop, resulting in a denial of service [1].

Impact

Successful exploitation leads to a denial of service, as the application becomes unresponsive and consumes resources (e.g., CPU time) indefinitely. The impact is limited to availability; confidentiality and integrity are not affected. The hang persists until the process is terminated externally.

Mitigation

As of the publication date, no patch has been released for this vulnerability in GraphicsMagick 1.3.27. Users are advised to avoid processing untrusted BMP files, consider using alternative image processing tools, or apply workarounds such as input validation to reject files with suspicious bit-field mask values. Monitoring for future updates from the GraphicsMagick project is recommended [1].