CVE-2019-12976

Vulnerability

ImageMagick version 7.0.8-34 contains a memory leak in the ReadPCLImage function located in coders/pcl.c. The issue occurs when the function determines a required delegate (monochrome, CMYK, or color) is unavailable — the code returns a NULL pointer without first destroying the allocated image structure via DestroyImage, leaving that memory orphaned [1].

Exploitation

An attacker needs to provide a PCL image file that triggers the delegate-missing code path. No authentication or special network position is required; the attacker simply supplies a crafted file to an application or service using the vulnerable ImageMagick version to read PCL images [1].

Impact

Repeatedly invoking the vulnerable code path causes a cumulative memory leak, which may lead to denial of service (DoS) by exhausting available memory on the system hosting the vulnerable software. No code execution or information disclosure is reported [1].

Mitigation

The issue was reported on June 21, 2019, and the fix was applied in the ImageMagick codebase shortly after by adding a call to DestroyImage before the return statement. Users should update to a version containing the fix or apply the patch to coders/pcl.c as shown in the reference. No workaround is documented; if updating is not possible, consider restricting processing of untrusted PCL files [1].