CVE-2019-13137

Vulnerability

In ImageMagick versions before 7.0.8-50, the function ReadPSImage in coders/ps.c contains a memory leak. When parsing a PostScript file, if the page_geometry string is allocated via GetPageGeometry and then an invalid geometry is encountered, the code returns early without freeing page_geometry via DestroyString. This occurs in the error handling path after ThrowMagickException when flags == NoValue. The leak is present in both ImageMagick 7 and ImageMagick 6 (where the variable is named geometry). [1][2][3]

Exploitation

An attacker can trigger this memory leak by providing a crafted PostScript file that causes the ParseMetaGeometry function to return NoValue. No authentication is required; the attacker only needs to submit the malicious file to an application using ImageMagick to process it. The leak occurs during the error handling before the function returns NULL. [1]

Impact

Repeatedly processing such malformed files can exhaust available memory, leading to a denial of service (DoS) condition. The vulnerability does not allow code execution or information disclosure; it is a resource exhaustion issue. [1]

Mitigation

The fix was released in ImageMagick version 7.0.8-50 and in ImageMagick6 commit 7d11230. Users should upgrade to the patched version. The commit for ImageMagick 7 adds page_geometry=DestroyString(page_geometry); before the return statement, and the ImageMagick6 commit adds geometry=DestroyString(geometry);. No workaround is available other than updating. [2][3]