CVE-2019-13133

Vulnerability

ImageMagick versions prior to 7.0.8-50 contain a memory leak vulnerability in the ReadBMPImage function within coders/bmp.c. The issue arises from incorrect error handling when GetNextImageInList(image) returns NULL: the original code returns without releasing the image list, causing a memory leak [1]. The affected code path is reachable when processing a crafted BMP file that causes the multi-frame read loop to fail. The same pattern exists in ReadVIFFImage in coders/viff.c [1].

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted BMP image to an application using ImageMagick. No authentication or special network position is required if the application accepts user-supplied images. The erroneous code path triggers when the image read loop encounters a failure condition, leading to the leak on each unsuccessful attempt [1].

Impact

Successful exploitation causes a memory leak, which can lead to resource exhaustion and denial of service (DoS). The impact is limited to availability, as an attacker can cause the consuming application to run out of memory over repeated processing of malicious images [1].

Mitigation

The vulnerability is fixed in ImageMagick version 7.0.8-50. The commit fe3066122ef72c82415811d25e9e3fad622c0a99 corrects the logic by replacing the premature return with a break statement and setting a status flag, ensuring the image list is properly cleaned up [2]. Users should upgrade to version 7.0.8-50 or later. No workaround is documented; processing untrusted BMP files should be avoided until the patch is applied.