CVE-2018-7470

Vulnerability

A segmentation violation vulnerability exists in ImageMagick 7.0.7-22 Q16 in the IsWEBPImageLossless function within coders/webp.c. The issue occurs when a crafted WebP file is processed, causing a NULL or invalid pointer to be dereferenced in the ReadWebPLSBWord function (line 157 calls ReadWebPLSBWord at line 196). This is triggered during the identify command or any operation that reads a WebP image, as shown by the ASAN trace in the issue report [1].

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted WebP file to an application using the vulnerable ImageMagick version (7.0.7-22). No special privileges are required; the attacker only needs to convince a user or automated process to process the malicious file (e.g., via identify -verbose ./poc). The crash occurs during image parsing, before any sanitization checks, leading to a segmentation violation [1].

Impact

Successful exploitation results in a denial of service (DoS) due to a segmentation violation, causing the application to crash. The crash is immediate and can be triggered repeatedly with the same crafted file. No remote code execution or data corruption is reported, but the crash can disrupt service availability [1].

Mitigation

As of the publication date (2018-02-25), ImageMagick released version 7.0.7-23 which contains a fix for this issue. Users should upgrade to ImageMagick 7.0.7-23 or later. There is no known workaround; however, limiting file uploads or disabling WebP support via policy configuration (e.g., ``) may prevent exploitation until patching is possible [1].