CVE-2018-9018

Vulnerability

In GraphicsMagick 1.3.28, the ReadMNGImage function in coders/png.c contains a divide-by-zero error at line 4638. This occurs when processing a specially crafted MNG file, leading to a floating-point exception (FPE) and program crash. The vulnerability is reachable through any operation that triggers MNG decoding, such as gm identify or gm convert.

Exploitation

An attacker can exploit this vulnerability by providing a malicious MNG file to a target using GraphicsMagick 1.3.28. No authentication or special privileges are required; the attacker only needs to convince the victim (or an automated service) to process the file using GraphicsMagick. The crash is triggered immediately upon parsing the malformed MNG data, as demonstrated by the AddressSanitizer stack trace in the bug report [1].

Impact

Successful exploitation results in a denial of service (DoS) due to the program aborting with a floating-point exception. The crash terminates the GraphicsMagick process, potentially disrupting image processing workflows. No code execution or data disclosure has been reported for this vulnerability.

Mitigation

As of the available references, no official patch has been explicitly announced. Users are advised to upgrade to a version of GraphicsMagick later than 1.3.28, as the issue was likely fixed in subsequent releases. Until an update is applied, avoid processing untrusted MNG files with GraphicsMagick.