CVE-2019-11010

Vulnerability

GraphicsMagick 1.4 snapshot-20190322 Q8 contains a memory leak in the ReadMPCImage function within coders/mpc.c. The leak occurs when processing a crafted MPC image file, specifically during the allocation of strings without proper deallocation on code paths that lead to errors [1]. The vulnerable version is the snapshot from 20190322; earlier and later versions may also be affected.

Exploitation

An attacker can trigger the memory leak by supplying a specially crafted MPC image file to the GraphicsMagick convert utility (or any function that reads MPC images). No special privileges are required; the attacker only needs to deliver the file to a user or process that invokes GraphicsMagick on it [1]. The leak can be reproduced with a command like gm convert ./crafted.mpc /dev/null.

Impact

Successful exploitation causes the application to consume increasing amounts of memory without freeing it, eventually leading to a denial-of-service condition. The leak is verified to be 2304 bytes in 9 allocations per affected operation, but repeated processing can exhaust system memory [1]. No code execution or privilege escalation is achieved.

Mitigation

As of the publication date (2019-04-08), no official fixed version of GraphicsMagick has been released. The bug was reported on the GraphicsMagick issue tracker [1]. Users should monitor for updates and apply a patch when available. As a workaround, avoid processing untrusted MPC files until a fix is released.