CVE-2019-13301

Vulnerability

ImageMagick version 7.0.8-50 Q16 contains memory leaks in the AcquireMagickMemory function of MagickCore/memory.c (line 478) caused by improper error handling in AnnotateImage (MagickCore/annotate.c). When AnnotateImage fails after allocating memory for text lines or after setting an image storage class, the allocated resources (annotate_info, annotate, and textlist) are not freed, leading to memory leaks over time [1][4]. The issue is triggered when processing specially crafted image files with specific command-line arguments, such as those involving -draw, -preview, -resize and other operators [2][3].

Exploitation

An attacker needs to trick a user or automated system into opening or processing a specially crafted image file using a vulnerable ImageMagick installation [1]. The attacker supplies a malformed image that, when processed with certain command-line options (e.g., magick -black-point-compensation ... triggers AnnotateImage failure paths), causes memory to be allocated but not freed [2][3]. Multiple runs of the command may be required to observe the leak, as the bug is intermittent [2]. No authentication or special network position is required beyond delivering the file to the victim's system.

Impact

Successful exploitation results in progressive memory leak, leading to denial of service as the ImageMagick process consumes increasing amounts of memory, potentially exhausting system resources [1][2][3]. In addition to memory leaks, related heap-buffer-overflow and heap-use-after-free vulnerabilities have been reported in MagickCore/resize.c and MagickCore/memory.c that could cause crashes or potentially arbitrary code execution under certain conditions [2][3][4]. The attacker may achieve code execution with the privileges of the user running ImageMagick [1].

Mitigation

Ubuntu released an advisory (USN-4192-1) on 2019-07-05 recommending updating imagemagick packages to the latest version for Ubuntu 19.10 (eoan) and other supported releases [1]. The upstream fix is available in commit f595a1985233c399a05c0c37cc41de16a90dd025, which adds proper cleanup of annotate_info, annotate, and textlist resources before returning from AnnotateImage on error [4]. Users should update to ImageMagick versions containing this commit (e.g., 7.0.8-50 or later). As a workaround, avoid processing untrusted images with vulnerable command-line options until patched. This CVE is not known to be listed in CISA's Known Exploited Vulnerabilities catalog.